312-50V10 · Question #622
A distributed port scan operates by:
The correct answer is D. Having multiple computers each scan a small number of ports, then correlating the results. A distributed port scan splits the scanning work across multiple machines, each probing a small number of ports, then combines the results to build a complete picture while evading detection.
Question
A distributed port scan operates by:
Options
- ABlocking access to the scanning clients by the targeted host
- BUsing denial-of-service software against a range of TCP ports
- CBlocking access to the targeted host by each of the distributed scanning clients
- DHaving multiple computers each scan a small number of ports, then correlating the results
How the community answered
(40 responses)- A3% (1)
- B8% (3)
- C3% (1)
- D88% (35)
Why each option
A distributed port scan splits the scanning work across multiple machines, each probing a small number of ports, then combines the results to build a complete picture while evading detection.
Blocking access to scanning clients is a defensive action taken by the target, not a description of how the scanning technique itself works.
Using denial-of-service software against TCP ports describes a DoS attack, which is a completely different category of attack from reconnaissance scanning.
Distributed scanning clients probe the target - they do not block access to it, as that would defeat the purpose of the scan.
In a distributed port scan, multiple coordinated hosts each scan a different subset of ports on the target, then their results are aggregated centrally. This approach keeps each individual source's scan rate low, making it difficult for intrusion detection systems to flag any single scanner as malicious based on volume thresholds.
Concept tested: Distributed port scanning technique and IDS evasion
Source: https://nmap.org/book/man-bypass-firewalls-ids.html
Topics
Community Discussion
No community discussion yet for this question.