CHAPTER 3 Network Scanning and Enumeration

What is the effect of the -Pn flag in nmap? A. Disables ping and skips host discovery B. Prevents DNS resolution C. Disables port scanning and forces a simple ping scan D. Outputs scan details in XML format

A

Which popular tool is used for wireless discovery and offers many of the same features as airodump-ng? A. Kismet B. Nmap C. Shodan D. Onesixtyone

A

Which of the following NSE scripts would be best used to enumerate shared storage volumes on a network? (Choose two.) A. smb-enum-shares B. smb-enum-domains C. smtp-enum-users D. nfs-showmount

AD

Which component of the aircrack-ng suite of tools is used to put wireless adaptors into monitor mode? A. Aireplay-ng B. Airmon-ng C. Airodump-ng D. Airdecap-ng

B

Which nmap flag is used to disable DNS resolution of hostnames? A. -sL B. -n C. -oG D. -Pn

B

Which nmap flag should precede a file containing a list of targets to be scanned? A. -Pn B. -iL C. -sn D. -oA

B

Which of the following flags would be recommended to further enumerate the server running on port 3306? A. -sT B. -script=mysql-info C. -info3306 D. -script=http-enum

B

Which of the following is an open-source suite of tools useful for conducting RF communication monitoring and security testing of wireless networks? A. Shodan B. Aircrack-ng C. Nmap D. Theharvester

B

Which of the following is not a primary type of frame defined by the IEEE 802.11 wireless communication standard? A. Control frame B. Beacon frame C. Data frame D. Management frame

B

Which of the following nmap options would result in the ports shown being scanned? A. -sL B. -top-ports=200 C. -v D. -sS

B

Which open-source command-line tool is used for several penetration test-focused activities on both wired and wireless networks, such as surveying hosts for open ports, fingerprinting operating systems, and collecting service banners? A. Shodan B. Nmap C. Aircrack-ng D. Theharvester

B

Which type of primary frame (defined by the IEEE 802.11 wireless standard) enables stations to establish and sustain communication over the network with an access point? A. Disassociation frame B. Management frame C. Data frame D. Control frame

B

In the output presented, which NSE script revealed that the FTP server present permits anonymous login? A. ftp-syst B. ssh-hostkey C. ftp-anon D. FTP server status

C

Of the following options, which nmap flag could produce output in the format shown? A. -oX B. -iL C. -oN D. -T

C

What is the effect of the -v flag in nmap? A. Denotes a list of targets to scan B. Prevents DNS resolution C. Increases the verbosity level of scan output D. Disables ping and skips host discovery

C

Which subtype of management frame contains details about a wireless access point (including but not limited to the SSID, encryption details, MAC address, and Wi-Fi channel) that can enable a malicious agent to eavesdrop on a wireless network? A. Authentication frame B. Request to Send (RTS) frame C. Beacon frame D. Association request frame

C

Which type of primary frame (defined by the IEEE 802.11 wireless standard) facilitates delivery of data frames to each station? A. Deauthentication frame B. Disassociation frame C. Control frame D. Management frame

C

Of the following options, which flags could have produced the output presented? A. -sU B. -O C. -sV D. -A

D

What is the effect of the -PS flag in nmap? A. Triggers SCTP discovery to named ports B. Triggers TCP ACK discovery to named ports C. Triggers UDP discovery to named ports D. Triggers TCP SYN discovery to named ports

D

Which of the following is an active scanning technique used to aid in the process of information gathering, with the goal of identifying hosts that are alive and listening on the network? A. Port scanning B. Wardriving C. Stumbling D. Host discovery

D