RCE 10 - Port Scanning

Which tool is most commonly used for port scanning?

• Wireshark

• Nmap

• Metasploit

• Burp Suite

What does a SYN scan (-sS) in Nmap do?

• Completes a full TCP handshake

• Sends a SYN and waits for SYN-ACK, then sends RST

• Sends an ACK to open ports only

• Sends UDP packets to all ports

Which scan type is also known as a “stealth” scan because it never completes the TCP handshake?

• TCP Connect scan

• UDP scan

• FIN scan

• SYN scan

By default, which port range does Nmap scan when no ports are specified?

• 1-1024

• 1-65535

• 0-1023

• 1025-49151

What is the purpose of an “Xmas scan” (-sX)?

• To turn on the SYN, URG, and PSH flags and see which ports respond

• To send Christmas-themed banners on open services

• To use Xmas holiday for scanning events

• To detect OS by packet response times

Which Nmap option enables service version detection?

• -sV

• -O

• -A

• -v

What response indicates a port is closed during a SYN scan?

• No response

• RST packet

• SYN-ACK packet

• ICMP “destination unreachable”

Which scan is most likely to be blocked by a basic firewall?

• Idle scan

• SYN scan

• UDP scan

• TCP Connect scan

What is an idle (zombie) scan used for?

• To scan ports without sending any packets

• To scan through a third-party “zombie” host for stealth

• To scan only low-numbered ports

• To scan for zombie processes on the target

Which Nmap flag turns on OS detection?

• O

• sS

• sU

• sP