A security analyst is conducting an unknown environment test from 192.168.3.3. The analyst wants to limit observation of the penetration tester's activities and lower the probability of detection by…

The correct answer is D. nmap -scanflags SYNFIN 192.168.5.5. The '-scanflags' option allows the user to specify custom TCP flags, and using uncommon flag combinations like SYNFIN can help avoid detection by some intrusion detection systems, as this traffic may be less likely to trigger alerts compared to standard scans. This technique…

Information Gathering and Vulnerability Scanning

Question

A security analyst is conducting an unknown environment test from 192.168.3.3. The analyst wants to limit observation of the penetration tester's activities and lower the probability of detection by intrusion protection and detection systems. Which of the following Nmap commands should the analyst use to achieve this objective?

Options

Anmap -F 192.168.5.5
Bnmap -datalength 2 192.168.5.5
Cnmap -D 0.5.2.2 192.168.5.5
Dnmap -scanflags SYNFIN 192.168.5.5

How the community answered

(17 responses)

A
6% (1)
B
6% (1)
C
12% (2)
D
76% (13)

Explanation

The '-scanflags' option allows the user to specify custom TCP flags, and using uncommon flag combinations like SYNFIN can help avoid detection by some intrusion detection systems, as this traffic may be less likely to trigger alerts compared to standard scans. This technique, known as a stealth scan, is designed to evade firewall and intrusion detection system rules that are set to recognize common scan types.

Topics

#Nmap#Stealth Scanning#IDS Evasion#Penetration Testing Tools

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice