312-50 Exam AI-Powered | Exam-Dumps.net (Page: 11)

QUESTION: 51

What port scanning method involves sending spoofed packets to a target system and then looking for adjustments to the IPID on a zombie system?

Blind Port Scanning
Idle Scanning
Bounce Scanning
Stealth Scanning
UDP Scanning

Answer(s): B

Explanation:

From NMAP:-sI <zombie host[:probeport]> Idlescan: This advanced scan method allows fora truly blind TCP port scan of the target (meaning no packets are sent tothe tar- get from your real IP address). Instead, a unique side-channelattack exploits predictable "IP fragmentation ID" sequence generation onthe zombie host to glean information about the open ports on the target.

Reveal Solution Next Question

QUESTION: 52

What port scanning method is the most reliable but also the most detectable?

Null Scanning
Connect Scanning
ICMP Scanning
Idlescan Scanning
Half Scanning
Verbose Scanning

Answer(s): B

Explanation:

A TCP Connect scan, named after the Unix connect() system call is the most accurate scanning method. If a port is open the operating system completes the TCP three-way handshake, and the port scanner immediately closes the connection.

Reveal Solution Next Question

QUESTION: 53

What does an ICMP (Code 13) message normally indicates?

It indicates that the destination host is unreachable
It indicates to the host that the datagram which triggered the source quench message will need to be re-sent
It indicates that the packet has been administratively dropped in transit
It is a request to the host to cut back the rate at which it is sending traffic to the Internet destination

Answer(s): C

Explanation:

CODE 13 and type 3 is destination unreachable due to communication administratively prohibited by filtering hence maybe they meant "code 13", therefore would be C). Note:A - Type 3B - Type 4C - Type 3 Code 13D - Typ4 4

Reveal Solution Next Question

QUESTION: 54

Because UDP is a connectionless protocol: (Select 2)

UDP recvfrom() and write() scanning will yield reliable results
It can only be used for Connect scans
It can only be used for SYN scans
There is no guarantee that the UDP packets will arrive at their destination
ICMP port unreachable messages may not be returned successfully

Answer(s): D,E

Explanation:

Neither UDP packets, nor the ICMP errors are guaranteed to arrive, so UDP scanners must also implement retransmission of packets that appear to be lost (or you will get a bunch of false positives).

Reveal Solution Next Question

QUESTION: 55

You are scanning into the target network for the first time. You find very few conventional ports open. When you attempt to perform traditional service identification by connecting to the open ports, it yields either unreliable or no results. You are unsure of what protocols are being used. You need to discover as many different protocols as possible. Which kind of scan would you use to do this?

Nmap with the –sO (Raw IP packets) switch
Nessus scan with TCP based pings
Nmap scan with the –sP (Ping scan) switch
Netcat scan with the –u –e switches

Answer(s): A

Explanation:

Running Nmap with the –sO switch will do a IP Protocol Scan. The IP protocol scan is a bit different than the other nmap scans. The IP protocol scan is searching for additional IP protocols in use by the remote station, such as ICMP, TCP, and UDP. If a router is scanned, additional IP protocols such as EGP or IGP may be identified.

Reveal Solution Next Question

EC-Council 312-50 (page: 11)

QUESTION: 51

Explanation:

QUESTION: 52

Explanation:

QUESTION: 53

Explanation:

QUESTION: 54

Explanation:

QUESTION: 55

Explanation: