Sam is a penetration tester hired by Inception Tech, a security organization. He was asked to perform port scanning on a target host in the network. While performing the given task, Sam sends…

Question

Options

• AXmas scan
• BIDLE/IPID header scan
• CTCP Maimon scan
• DACK flag probe scan

• A
  4% (2)
• B
  2% (1)
• C
  81% (39)
• D
  13% (6)

Explanation

TCP Maimon Scan Explanation

Why C is Correct: TCP Maimon scan (named after its discoverer, Uriel Maimon) works by sending FIN/ACK probe packets to target ports. On closed ports, BSD-derived systems respond with an RST packet, while open ports simply drop the packet - this behavior is the defining characteristic of this technique and exactly matches the scenario described.

Why the Distractors Are Wrong:

• A (Xmas Scan): Sends packets with FIN, PSH, and URG flags all set simultaneously (lighting up the packet "like a Christmas tree"), not FIN/ACK
• B (IDLE/IPID Header Scan): A stealthy technique that uses a zombie/idle host as an intermediary to scan targets, not direct FIN/ACK probes
• D (ACK Flag Probe Scan): Sends packets with only the ACK flag set, primarily used to map firewall rules and determine whether ports are filtered or unfiltered - not for identifying open/closed ports using FIN/ACK

Memory Tip: Think "Maimon = FIN/ACK Man" - the name "Maimon" contains the letter sequence to remind you it's the one scan that combines FIN + ACK together. If you see FIN/ACK probes on an exam, immediately think Maimon scan!

No community discussion yet for this question.