Exam 312-50v13 topic 1 question 114 discussion

Actual exam question from ECCouncil's 312-50v13

Question #: 114
Topic #: 1

Sam is a penetration tester hired by Inception Tech, a security organization. He was asked to perform port scanning on a target host in the network. While performing the given task, Sam sends FIN/ACK probes and determines that an RST packet is sent in response by the target host, indicating that the port is closed.
What is the port scanning technique used by Sam to discover open ports?

A. Xmas scan
B. IDLE/IPID header scan
C. TCP Maimon scan
D. ACK flag probe scan

Show Suggested Answer

Suggested Answer: C 🗳️

by Bob00036 at Jan. 12, 2025, 2:12 p.m.

Comments

Submit Cancel

e30b32d

1 month, 1 week ago

Selected Answer: C

In a TCP Maimon scan, the attacker sends a FIN/ACK combination (or sometimes just a FIN or FIN/PSH/URG flag combo) to a target port. The response behavior helps determine the port's status: If the port is closed, the target responds with an RST packet. If the port is open or filtered, no response is sent.

upvoted 1 times

...

killwitch

3 months, 4 weeks ago

Selected Answer: C

C. TCP Maimon scan. Sam sends FIN/ACK probes and gets RST packet in response. FIN/ACK probes followed by RST response follows exactly the Maimon scan definition.

upvoted 2 times

...

marcel9999

4 months ago

Selected Answer: C

This scan technique is very similar to NULL, FIN, and Xmas scan, but the probe used here is FIN/ACK. In most cases, to determine if the port is open or closed, the RST packet should be generated as a response to a probe request.

upvoted 2 times

...