nerdexam
EC-Council

312-50V11 · Question #622

A distributed port scan operates by:

The correct answer is D. Having multiple computers each scan a small number of ports, then correlating the results. A distributed port scan splits the scanning workload across many source machines so that no single host performs a complete scan, making detection and correlation by the target much harder.

Scanning Networks

Question

A distributed port scan operates by:

Options

  • ABlocking access to the scanning clients by the targeted host
  • BUsing denial-of-service software against a range of TCP ports
  • CBlocking access to the targeted host by each of the distributed scanning clients
  • DHaving multiple computers each scan a small number of ports, then correlating the results

How the community answered

(20 responses)
  • B
    5% (1)
  • C
    5% (1)
  • D
    90% (18)

Why each option

A distributed port scan splits the scanning workload across many source machines so that no single host performs a complete scan, making detection and correlation by the target much harder.

ABlocking access to the scanning clients by the targeted host

Blocking access from scanning clients to the targeted host describes a firewall or access-control response, not the mechanics of how a distributed scan operates.

BUsing denial-of-service software against a range of TCP ports

Using denial-of-service software against a TCP port range describes a DoS attack, not a port scanning technique.

CBlocking access to the targeted host by each of the distributed scanning clients

Blocking access to the targeted host by the scanning clients is nonsensical in this context and describes no recognized scanning methodology.

DHaving multiple computers each scan a small number of ports, then correlating the resultsCorrect

In a distributed port scan, a coordinated group of machines each probe only a small subset of ports or hosts, then the results are aggregated centrally. Because each individual scanner sends very few packets to the target, threshold-based IDS rules and rate-limiting defenses are less likely to trigger on any one source, effectively evading detection while still gathering full scan data.

Concept tested: Distributed port scanning evasion technique

Source: https://nmap.org/book/man-bypass-firewalls-ids.html

Topics

#distributed scanning#port scanning#scan coordination

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice