nerdexam
EC-Council

312-50V11 · Question #198

The following is part of a log file taken from the machine on the network with the IP address of 192.168.1.106: What type of activity has been logged?

The correct answer is D. Port scan targeting 192.168.1.106. The log entries show sequential connection attempts to multiple ports on 192.168.1.106 from another host, which is the defining characteristic of a port scan targeting that machine.

Scanning Networks

Question

The following is part of a log file taken from the machine on the network with the IP address of 192.168.1.106:

What type of activity has been logged?

Exhibit

312-50V11 question #198 exhibit

Options

  • APort scan targeting 192.168.1.103
  • BTeardrop attack targeting 192.168.1.106
  • CDenial of service attack targeting 192.168.1.103
  • DPort scan targeting 192.168.1.106

How the community answered

(24 responses)
  • A
    4% (1)
  • B
    17% (4)
  • C
    4% (1)
  • D
    75% (18)

Why each option

The log entries show sequential connection attempts to multiple ports on 192.168.1.106 from another host, which is the defining characteristic of a port scan targeting that machine.

APort scan targeting 192.168.1.103

A port scan targeting 192.168.1.103 would show the probes directed at .103 as the destination; the log belongs to .106 and records traffic received by that host.

BTeardrop attack targeting 192.168.1.106

A teardrop attack involves sending malformed, overlapping IP fragments to crash the target's TCP/IP stack - it would not appear as sequential port connection attempts in a standard log.

CDenial of service attack targeting 192.168.1.103

A denial-of-service attack against .103 would appear as high-volume traffic sent from .106 toward .103, which is the reverse of what the log on .106 would capture.

DPort scan targeting 192.168.1.106Correct

A port scan is identified by rapid, sequential or systematic connection attempts across multiple ports on a single target IP. Because the log records multiple attempts directed at 192.168.1.106 across different port numbers, the target of the scan is 192.168.1.106, not .103. The machine at .106 is the one logging inbound probe packets.

Concept tested: Identifying port scan activity from log analysis

Source: https://nmap.org/book/man-port-scanning-basics.html

Topics

#port scan#log analysis#network traffic#intrusion detection

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice