Exam 312-38 topic 1 question 385 discussion

Actual exam question from ECCouncil's 312-38

Question #: 385
Topic #: 1

Cindy is the network security administrator for her company. She just got back from a security conference in Las Vegas where they talked about all kinds of old and new security threats; many of which she did not know of. She is worried about the current security state of her company's network so she decides to start scanning the network from an external IP address. To see how some of the hosts on her network react, she sends out SYN packets to an IP range. A number of
IPs respond with a SYN/ACK response. Before the connection is established, she sends RST packets to those hosts to stop the session. She has done this to see how her intrusion detection system will log the traffic. What type of scan is Cindy attempting here?

A. The type of scan she is using is called a NULL scan.
B. Cindy is attempting to find live hosts on her company's network by using a XMAS scan.
C. Cindy is using a half-open scan to find live hosts on her network.
D. She is utilizing a RST scan to find live hosts that are listening on her network.

Show Suggested Answer

Suggested Answer: C 🗳️

by keno_ at May 13, 2022, 1:07 p.m.

Comments

Submit Cancel

keno_

6 months, 2 weeks ago

SYN then RST is not a half-open scan. SYN Scan– Also referred to as a half-open scan, it only sends a SYN, and waits for a SYN-ACK response from the target. If a response is received, the scanner never responds. Since the TCP connection was not completed, the system doesn’t log the interaction, but the sender has learned if the port is open or not. https://www.paloaltonetworks.com/cyberpedia/what-is-a-port-scan#:~:text=SYN%20Scan%E2%80%93%20Also%20referred%20to,port%20is%20open%20or%20not.

upvoted 3 times

...