Pentesting Practice – MCQs

Which scan type uses half-open TCP connections to avoid detection?

• TCP Connect Scan

• SYN Scan

• FIN Scan

• Xmas Scan

Which Nmap option is used for OS detection?

• -O

• -sV

• -sU

• -O

Which Nmap scan would you use to detect UDP services?

• -sT

• -sS

• -sU

• -sn

Which type of scan helps identify live hosts without port scanning?

• -sV

• -sn

• -T4

• -p

Which scan sends TCP packets with unusual flags to bypass firewalls?

• ACK scan

• Xmas scan

• Null scan

• Connect scan

Which Nmap flag enables service version detection?

• -O

• -sV

• -T5

• -Pn

Which scanning technique is least stealthy and easily detected?

• SYN scan

• TCP Connect scan

• UDP scan

• Null scan

Which timing option in Nmap is used for fastest scanning (but noisier)?

• -T1

• -T3

• -T4

• -T5

Which Nmap scan is used to test firewall rules (not port states)?

• -sS

• -sU

• -sA (ACK scan)

• -sn

What does the Nmap option `-sS -Pn -T4` do?

• UDP scan

• Aggressive ping sweep

• SYN scan, skip host discovery, fast timing

• Version detection