Great News!
Many students who study using our platform have reported that a large number of the practice questions here are very similar to those that appear in real exams. View Courses
Many students who study using our platform have reported that a large number of the practice questions here are very similar to those that appear in real exams. View Courses
A penetration tester ran an Nmap scan on an Internet-facing network device with the -F option and found a few open ports. To further enumerate, the tester ran another scan using the following command: nmap -O -A -sS -p- 100.100.100.50
Nmap returned that all 65,535 ports were filtered
Which of the following MOST likely occurred on the second scan?
Correct Answer: A. A firewall or IPS blocked the scan.
In the first scan, the penetration tester used nmap -F, which performs a fast scan of only the most common 100 ports. This scan succeeded and returned a few open ports.
In the second scan, the tester used:
css
nmap -O -A -sS -p- 100.100.100.50
This command does the following:
-O → Enables OS detection.-A → Enables aggressive scan mode (OS detection, version detection, script scanning, and traceroute).-sS → Performs a stealth SYN scan.-p- → Scans all 65,535 ports instead of just common ones.Since all 65,535 ports were returned as "filtered," this strongly indicates that a firewall or Intrusion Prevention System (IPS) blocked the scan.
Why?
-F) succeeded because it was less aggressive and only checked common ports, which may have been allowed through.-p- -A -O -sS) was much more intrusive, triggering security controls to block the scanning attempt.Why the Other Options Are Incorrect:
The penetration tester used unsupported flags.
The flags used (-O -A -sS -p-) are all valid and commonly used in penetration tests.
The edge network device was disconnected.
If the device was disconnected, Nmap would not receive any response and would likely return host down (or no response) instead of all ports filtered.
The scan returned ICMP echo replies.
If an ICMP response (like a ping reply) was received, it would not result in all ports being marked as filtered.
No Payment Cards Needed
Discover a range of courses designed to provide you with the knowledge and skills needed to excel in your chosen field.
You don’t need one month to study and pass your test.
With Prepsaret, it takes you a few days to grasp all the concepts needed to pass your exams
