312-50V11 · Question #622
A distributed port scan operates by:
The correct answer is D. Having multiple computers each scan a small number of ports, then correlating the results. A distributed port scan splits the scanning workload across many source machines so that no single host performs a complete scan, making detection and correlation by the target much harder.
Question
A distributed port scan operates by:
Options
- ABlocking access to the scanning clients by the targeted host
- BUsing denial-of-service software against a range of TCP ports
- CBlocking access to the targeted host by each of the distributed scanning clients
- DHaving multiple computers each scan a small number of ports, then correlating the results
How the community answered
(20 responses)- B5% (1)
- C5% (1)
- D90% (18)
Why each option
A distributed port scan splits the scanning workload across many source machines so that no single host performs a complete scan, making detection and correlation by the target much harder.
Blocking access from scanning clients to the targeted host describes a firewall or access-control response, not the mechanics of how a distributed scan operates.
Using denial-of-service software against a TCP port range describes a DoS attack, not a port scanning technique.
Blocking access to the targeted host by the scanning clients is nonsensical in this context and describes no recognized scanning methodology.
In a distributed port scan, a coordinated group of machines each probe only a small subset of ports or hosts, then the results are aggregated centrally. Because each individual scanner sends very few packets to the target, threshold-based IDS rules and rate-limiting defenses are less likely to trigger on any one source, effectively evading detection while still gathering full scan data.
Concept tested: Distributed port scanning evasion technique
Source: https://nmap.org/book/man-bypass-firewalls-ids.html
Topics
Community Discussion
No community discussion yet for this question.