Name:
Class:
Date:
Page 1
1. Port scanning is a method of finding out which services a host computer offers.
a.
True
b.
False
ANSWER:
True
2. You can search for vulnerabilities in a host computer by using a port-scanning tool.
a.
True
b.
False
ANSWER:
True
3. An open port allows access to specific applications and cannot be vulnerable to attack.
a.
True
b.
False
ANSWER:
False
4. In a NULL scan, all packet flags are turned on.
a.
True
b.
False
ANSWER:
False
5. Attackers typically use ACK scans to get past a firewall or other filtering devices.
a.
True
b.
False
ANSWER:
True
6. What type of port scan is similar to a SYN scan and is risky to use because it relies on the attacked
computer’s OS?
a.
XMAS
b.
ACK
c.
NULL
d.
Connect
ANSWER:
d
7. In a normal TCP session, the sender sends a packet to another computer with which of the following flags
set?
a.
SYN/ACK flag
b.
SYN flag
c.
No flag
d.
Reset flag
ANSWER:
b
8. What type of port scan has the FIN, PSH, and URG flags set?
Name:
Class:
Date:
Page 2
a.
NULL scan
b.
connect scan
c.
XMAS scan
d.
ACK scan
ANSWER:
c
9. Closed ports respond to a NULL scan with what type of packet?
a.
RST
b.
SYN
c.
Ping
d.
ACK
ANSWER:
a
10. In an ACK scan, if the attacked port returns an RST packet the attacked port is considered to be operating in
what state?
a.
open
b.
closed
c.
unfiltered
d.
unassigned
ANSWER:
c
11. When a TCP three-way handshake ends, both parties send what type of packet to end the connection?
a.
SYN
b.
ACK
c.
FIN
d.
RST
ANSWER:
c
12. What open source port-scanning tool is considered to be the standard port-scanning tool for security
professionals?
a.
NULL
b.
NMap
c.
NScanner
d.
PortGhost
ANSWER:
b
13. If an attacker decides to implement a less obvious port-scan, or stealth attack, which of the following
techniques would be appropriate to make their activities more difficult to detect?
a.
increase their scan speeds
b.
limit their tool set
c.
increase their scan speeds
Name:
Class:
Date:
Page 3
d.
limit their scan speeds
ANSWER:
d
14. What open-source network utility allows you to use plug-ins to run test programs (scripts) that can be
selected from the client interface?
a.
Uniscan
b.
Fping
c.
Nessus
d.
OpenVAS
ANSWER:
d
15. When using a port-scanner, what procedure can be conducted to identify which IP addresses belong to
active hosts?
a.
ping sweep
b.
ping check
c.
network sweep
d.
ICMP probing
ANSWER:
a
16. What network security tool, usually included with Kali Linux, allows a user to ping multiple IP addresses?
a.
Nmap
b.
Fping
c.
Tcpdump
d.
Nessus
ANSWER:
b
17. What advanced port-scanning tool can allow a security tester to bypass filtering devices by injecting crafted
or otherwise modified IP-packets into a network?
a.
Hping
b.
NetTools
c.
Nessus
d.
Nmap
ANSWER:
a
18. When security professionals create a packet, they may choose to specifically set which of the following
fields to help initiate a response from a target computer?
a.
box
b.
flag
c.
open
d.
id
ANSWER:
b
Name:
Class:
Date:
Page 4
19. Which of the following describes a flexible program that automates a task that takes too much time to
perform manually?
a.
Nmap
b.
open source utility
c.
customized script
d.
Fping
ANSWER:
c
20. Which of the following describes a text file containing multiple commands that would usually be entered
manually at the command prompt?
a.
script
b.
port-scanner
c.
application
d.
configuration file
ANSWER:
a
21. When using the text editor vim what command appends text after the insertion point?
a.
X
b.
A
c.
Delete Key
d.
ZZ
ANSWER:
b
22. When writing a script which statement allows you to avoid creating an endless loop in your script?
a.
count
b.
while
c.
bin
d.
do
ANSWER:
b
23. Which statement is where the script performs its main task?
a.
do
b.
while
c.
count
d.
bin
ANSWER:
a
24. Which vi command deletes the current line?
a.
D
b.
dl
c.
Dd
Name:
Class:
Date:
Page 5
d.
Dw
ANSWER:
c
25. In a Linux script, which of the lines is important because it identifies the file as a script?
a.
#!/bin/sh
b.
#!/bin/script
c.
#!/bin/shscript
d.
#!/bin/sc
ANSWER:
a
26. In any *NIX system, after saving a script named “script_name,” you need to make it executable so that you
can run it. Which command will accomplish this task from the command line?
a.
chmod +execute script_name
b.
chmod +x script_name
c.
chmod -execute script_name
d.
chmod -x script_name
ANSWER:
b
27. To verify if all the IP addresses of a network are being used by computers that are up and running, you can
use a port scanner to perform what procedure on a range of IP addresses?
a.
ping
b.
tracert
c.
Nmap
d.
port filtering
ANSWER:
a
28. Nmap has a GUI front end that makes it easier to work with some of the complex options by providing a
GUI. Which of the following is the Nmap GUI front end?
a.
Nmap GUI
b.
Fping
c.
Zenmap
d.
Hping
ANSWER:
a
29. Some attackers want to be hidden from network devices or IDSs that recognize an inordinate amount of
pings or packets being sent to their networks. Which of the following attacks are more difficult to detect?
a.
stealth
b.
silent
c.
planned
d.
covert
ANSWER:
a
Name:
Class:
Date:
30. One of the limitations when using “ping sweeps” is that many network administrators configure nodes not to
respond to ICMP Echo Requests. What type of ICMP Echo message is being disabled by these administrators?
a.
ping
b.
test
c.
acknowledge
d.
reply
ANSWER:
d
31. Why is it important for you as a security tester to understand and be able to create scripts?
ANSWER:
Some tools might need to be modified to better suit your needs as a security tester. Creating a customized
script-a computer program that automates a task that takes too much time to perform manually-can be a time-
saving solution. Fping can use an input file to perform ping sweeps. Creating an input file manually with
thousands of IP addresses isn’t worth the time. Instead, most security testers rely on their basic programming
skills to write a script for creating an input file.
32. Why is it important for a security tester to be able to use Nmap?
ANSWER:
Nmap has become one of the most popular port scanners and adds new features constantly, such as OS
detection and fast multiple-probe ping scanning. Nmap also has a GUI front end called Zenmap that makes
working with complex options easier. Nmap has been enhanced over the years because, like many other
security tools, it’s open source; if bugs are found, users can offer suggestions for correcting them.
33. Explain why an attacker typically uses an ACK scan to bypass a firewall?
ANSWER:
ACK scan-Attackers typically use ACK scans to get past a firewall or other filtering device. A filtering device
looks for the SYN packet, the first packet in the three-way handshake, that the ACK packet was part of.
Remember this packet order: SYN, SYN/ACK, and ACK. If the attacked port returns an RST packet, the
packet filter was fooled, or there’s no packet-filtering device. In either case, the attacked port is considered to
be “unfiltered.”
34. Which ports should security professionals scan when doing a test?
ANSWER:
As a security tester, you need to know which ports attackers are going after so those ports can be closed or
protected. Security professionals must scan all ports when doing a test, not just the well-known ports Many
computer programs use port numbers outside the range of well-known ports. For example, pcAnywhere
operates on ports 65301, 22, 5631, and 5632. A hacker who discovers that port 65301 is open might want to
check the information at the Common Vulnerabilities and Exposures Website for a possible vulnerability in
pcAnywhere. After a hacker discovers an open service, finding a vulnerability or exploit isn’t difficult.
35. Why is port scanning useful for hackers?
ANSWER:
Port scanning helps you answer questions about open ports and services by enabling you to quickly scan
thousands or even tens of thousands of IP addresses. Many port-scanning tools produce reports of their
findings, and some give you best-guess assessments of which OS is running on a system. Most, if not all,
scanning programs report open ports, closed ports, and filtered ports in a matter of seconds. When a Web
server needs to communicate with applications or other computers, for example, port 80 is opened. An open
port allows access to applications and can be vulnerable to an attack. A closed port does not allow entry or
access to a service. For instance, if port 80 is closed on a Web server, users wouldn’t be able to access Web
sites. A port reported as filtered might indicate that a firewall is being used to allow specified traffic in or out
of the network.
36. How does a SYN scan work?
Name:
Class:
Date:
j.
ANSWER:
In a normal TCP session, a packet is sent to another computer with the SYN flag set. The receiving computer
sends back a packet with the SYN/ACK flag set, indicating an acknowledgment. The sending computer then
sends a packet with the ACK flag set. If the port to which the SYN packet is sent is closed, the computer
responds to the SYN packet with an RST/ACK packet. If a SYN/ACK packet is received by an attacker’s
computer, it quickly responds with an RST/ACK packet, closing the session. This is done so that a full TCP
connection is never made and logged as a transaction. In this sense, it is “stealthy.” After all, you don’t want a
transaction to be logged showing the IP address that connected to the attacked computer.
37. What is a UDP scan?
ANSWER:
In this type of scan, a UDP packet is sent to the target computer. If the port sends back an ICMP “Port
Unreachable” message, the port is closed. Again, not getting that message might imply the port is open, but
this isn’t always true. A firewall or packet-filtering device could undermine your assumptions.
38. What makes the OpenVAS tool flexible and unique?
ANSWER:
What makes this tool unique is the capability to update security check plug-ins when they become available.
An OpenVAS plug-in is a security test program (script) that can be selected from the client interface. The
person who writes the plug-in decides whether to designate it as dangerous, and the author’s judgment on
what’s considered dangerous might differ from yours.
39. What are the problems with depending on ping sweeps to find out which hosts are “live”?
ANSWER:
To find out which hosts are “live,” ping sweeps simply ping a range of IP addresses and see what type of
response is returned. The problem with relying on ping sweeps to identify live hosts is that a computer might
be shut down at the time of the sweep, indicating that the IP address does not belong to a live host. Another
problem with ping sweeps is that many network administrators configure nodes not to respond to an ICMP
Echo Request (type 8) with an ICMP Echo Reply (type 0). This doesn’t mean the computer isn’t alive; it just
means it isn’t replying to the attack computer at that moment. Add to that the possibility of a firewall filtering
out ICMP traffic, and you have many reasons for using caution when running ping sweeps.
40. If subnetting is used in an organization, why should you be extra cautious when performing ping sweeps?
ANSWER:
If a ping sweep is activated inadvertently on the range of hosts 193.145.85.65 to 193.145.85.127, an inordinate
amount of traffic could flood the network because the broadcast address 193.145.85.127 is included. This error
is more of a problem on a Class B address, but if you perform ping sweeps, make sure your client signs a
written agreement authorizing the testing.
Match each item with a statement below.
a.
Nmap
b.
Fping
c.
Hping
d.
Nessus
e.
closed port
f.
OpenVAS
g.
filtered port
h.
open port
i.
port scanning
ping sweep
Name:
Class:
Date:
Page 8
41. A popular port scanners that has the ability to use a GUI front end
ANSWER:
a
42. Allows you to ping multiple IP addresses simultaneously and is usually included in Kali Linux
ANSWER:
b
43. Tool for performing ping sweeps and used to bypass filtering devices by injecting crafted or otherwise
modified IP-packets
ANSWER:
c
44. The original utility from which OpenVas was developed
ANSWER:
d
45. A port state which does not allow entry or access to a service
ANSWER:
e
46. An open-source fork of Nessus
ANSWER:
f
47. A port state that may indicate a firewall is being used to allow specified traffic into or out of the network
ANSWER:
g
48. A port state that allows access to applications and can be vulnerable
ANSWER:
h
49. Allows you the ability to scan thousands or even tens of thousands of IP addresses quickly
ANSWER:
i
50. Performed by port scanners to scan large networks to identify which IP addresses belong to active hosts
ANSWER:
j