8 - Vulnerability Management Exam
Questions 100% Verified Complete
Answers New Update
Enumeration Tools -
correct answer ✅Used to identify and scan network ranges and
hosts belonging to the target and map out an attack surface.
This is performed to gather intelligence that can be turned into an
attack strategy, or conversely, when used as a defensive tool, to
reduce the attack surface and mitigate potential attack vectors.
Involve at least some sort of active connection to the target.
An active connection is one where the attacker transmits data to
the target.
The attacker machine may make obvious TCP connections to a
firewall, send repetitive DNS and reverse DNS queries, or transmit
phishing emails to targets within the network.
Active techniques are those that will be discovered if the victim is
logging or otherwise monitoring network and host connections.
,8 - Vulnerability Management Exam
Questions 100% Verified Complete
Answers New Update
Enumeration Tools: Open-source Intelligence (OSINT) -
correct answer ✅These tools query publicly available information,
mostly using web and social media search tools.
This can be considered a fully passive approach.
Enumeration Tools: Footprinting -
correct answer ✅These tools map out the layout of a network,
typically in terms of IP address usage, routing topology, and DNS
namespace (subdomains and hostnames).
Can be performed in active, nonstealthy modes to obtain quick
results at the risk of detection or by using slow semi-passive and
passive techniques.
Enumeration Tools: Fingerprinting -
correct answer ✅These tools perform host system detection to
map out open ports, OS type and version, file shares, running
services and applications, system uptime, and other useful
metadata.
,8 - Vulnerability Management Exam
Questions 100% Verified Complete
Answers New Update
Can be performed by active, semi-passive, and passive tools.
Nmap Security Scanner -
correct answer ✅Uses diverse methods of host discovery and
fingerprinting.
The tool is open-source software with packages for most versions of
Windows, Linux, and macOS.
It can be run from the command line or via a GUI.
Nmap: List scan (-sL) -
correct answer ✅This lists the IP addresses from the supplied
target range(s) and performs a reverse-DNS query to discover any
host names associated with those IPs.
This can be used to check that you have specified appropriate
targets. No probes are directed at the actual hosts.
, 8 - Vulnerability Management Exam
Questions 100% Verified Complete
Answers New Update
Nmap: TCP SYN ping (-PS <PortList>) -
correct answer ✅To defeat a firewall, the attacker might want to
probe ports other than the default HTTP/HTTPS ones.
There are numerous other host detection techniques, including TCP
ACK, UDP, SCTP INIT, and IP protocol ping.
Nmap: Sparse scanning (--scan-delay <Time>) -
correct answer ✅One of the principal means of making a scan
stealthy is to collect results over an extended period.
You can set Nmap to issue probes with significant delays between
each probe to try to defeat intrusion detection systems.
Of course, this makes host discovery a lengthy process. You can also
configure delays using a timing template (-Tn, where n is a number
from 0 to 5, with 0 being slowest).
Another IDS evasion technique is to scan the scope in a random
order (--randomize-hosts).
Questions 100% Verified Complete
Answers New Update
Enumeration Tools -
correct answer ✅Used to identify and scan network ranges and
hosts belonging to the target and map out an attack surface.
This is performed to gather intelligence that can be turned into an
attack strategy, or conversely, when used as a defensive tool, to
reduce the attack surface and mitigate potential attack vectors.
Involve at least some sort of active connection to the target.
An active connection is one where the attacker transmits data to
the target.
The attacker machine may make obvious TCP connections to a
firewall, send repetitive DNS and reverse DNS queries, or transmit
phishing emails to targets within the network.
Active techniques are those that will be discovered if the victim is
logging or otherwise monitoring network and host connections.
,8 - Vulnerability Management Exam
Questions 100% Verified Complete
Answers New Update
Enumeration Tools: Open-source Intelligence (OSINT) -
correct answer ✅These tools query publicly available information,
mostly using web and social media search tools.
This can be considered a fully passive approach.
Enumeration Tools: Footprinting -
correct answer ✅These tools map out the layout of a network,
typically in terms of IP address usage, routing topology, and DNS
namespace (subdomains and hostnames).
Can be performed in active, nonstealthy modes to obtain quick
results at the risk of detection or by using slow semi-passive and
passive techniques.
Enumeration Tools: Fingerprinting -
correct answer ✅These tools perform host system detection to
map out open ports, OS type and version, file shares, running
services and applications, system uptime, and other useful
metadata.
,8 - Vulnerability Management Exam
Questions 100% Verified Complete
Answers New Update
Can be performed by active, semi-passive, and passive tools.
Nmap Security Scanner -
correct answer ✅Uses diverse methods of host discovery and
fingerprinting.
The tool is open-source software with packages for most versions of
Windows, Linux, and macOS.
It can be run from the command line or via a GUI.
Nmap: List scan (-sL) -
correct answer ✅This lists the IP addresses from the supplied
target range(s) and performs a reverse-DNS query to discover any
host names associated with those IPs.
This can be used to check that you have specified appropriate
targets. No probes are directed at the actual hosts.
, 8 - Vulnerability Management Exam
Questions 100% Verified Complete
Answers New Update
Nmap: TCP SYN ping (-PS <PortList>) -
correct answer ✅To defeat a firewall, the attacker might want to
probe ports other than the default HTTP/HTTPS ones.
There are numerous other host detection techniques, including TCP
ACK, UDP, SCTP INIT, and IP protocol ping.
Nmap: Sparse scanning (--scan-delay <Time>) -
correct answer ✅One of the principal means of making a scan
stealthy is to collect results over an extended period.
You can set Nmap to issue probes with significant delays between
each probe to try to defeat intrusion detection systems.
Of course, this makes host discovery a lengthy process. You can also
configure delays using a timing template (-Tn, where n is a number
from 0 to 5, with 0 being slowest).
Another IDS evasion technique is to scan the scope in a random
order (--randomize-hosts).
