Module 2A. Active Reconnaissance - Scanning

Which of the following is OUTSIDE the scope of Active Reconnaissance?

• Open ports
• Live hosts
• Running services
• Payloads

Which of the following is NOT a tool to discover live hosts?

• whois
• arp-scan
• nmap
• ping sweep

Which of the following protocols CAN NOT be used for live host discovery?

• UDP
• ICMP
• ARP
• SSH

Which of the following can ONLY be used to scan for live host WITHIN the same subnet?

• nmap TCP ACK ping scan
• arp-scan
• ping sweep
• nmap UDP ping scan

Which of the following live hosts discovery scans send ICMP packets? Pick 2

• ping sweep
• nmap TCP SYN ping scan
• nmap ICMP ping (echo) scan
• nmap UDP ping scan

Which of the following nmap command will perform an ARP scan for live hosts discovery within the subnet 10.0.1.0/24?

• nmap -sn -sV 10.0.1.0/24
• nmap -sn -PR 10.0.1.0/24
• nmap -sn -PE 10.0.1.0/24
• sudo nmap -sn -PM 10.0.1.0/24

Which of the following flags specifies to scan all the 65535 ports? Pick 2

• nmap 10.0.1.2 -p 65535
• nmap 10.0.1.2 -p all
• nmap 10.0.1.2 -p-
• nmap 10.0.1.2 -p 0-65535

Which of the following nmap scans will perform a full three-way handshake to scan for open ports?

• UDP
• TCP SYN
• TCP Connect
• TCP ACK

Which of the following nmap scans is more likely to be detected by an IDS system?

• UDP
• TCP SYN
• TCP Connect
• TCP ACK

Which of the following nmap scans is considered stealthy?

• UDP
• TCP SYN
• TCP Connect
• TCP ACK