PenTest+ V2 Scan Timing and Stealth Quiz

1. True or False: ACK scans are useful for mapping firewall rules and identifying filtered ports.

True

False

Submit

3. Firewall evasion techniques during scanning may include which methods? (Select all that apply)

Packet fragmentation

Source port manipulation

Decoy addresses

Protocol encryption

Submit

4. What is the main difference between a vulnerability scan and a penetration test?

Scans identify vulnerabilities; tests exploit them and assess impact

Tests are faster than scans

Scans require more permissions

Tests only identify configuration issues

5. True or False: Nessus and OpenVAS can both perform both credentialed and non-credentialed vulnerability scans.

True

False

6. Which of the following best describes 'banner grabbing'?

Collecting service version information from open ports

Stealing promotional materials from a website

Blocking network traffic

Encrypting sensitive data

Submit

8. Which scan type sends only SYN packets and observes responses without completing the TCP handshake?

Connect scan

SYN scan

FIN scan

Null scan

9. What is a 'time-based evasion' technique in vulnerability scanning?

Inserting delays between scan packets to avoid detection

Scanning only during off-hours

Using multiple scan sessions over weeks

All of the above

10. Which tool is commonly used for passive information gathering and OSINT collection?

Metasploit

Shodan

Nessus

Burp Suite

11. Which scan timing template in Nmap is designed for stealth and takes significantly longer to complete?

T0 (Paranoid)

T3 (Normal)

T4 (Aggressive)

T5 (Insane)

Submit

13. What is the primary purpose of scan rate limiting during a penetration test?

Reduce false positives in results

Minimize network congestion and detection risk

Increase the accuracy of vulnerability data

Bypass firewall rules

14. Which of the following is a passive information gathering technique? (Select all that apply)

DNS enumeration

WHOIS lookups

Port scanning

Social engineering

Submit

15. In the context of vulnerability scanning, what does 'credentialed scanning' provide?

Faster scan completion times

More accurate and detailed vulnerability detection

Complete evasion of security controls

Lower bandwidth consumption

16. Which scanning method is most likely to trigger intrusion detection systems?

SYN scan with long delays

Aggressive full-connect scan

Slow fragmented scan

Decoy scan with spoofed packets

17. What does the idle scan technique accomplish in network reconnaissance?

Spoofs the source IP address to hide the attacker

Uses a zombie host to conduct port scans anonymously

Delays scan packets to evade firewalls

Encrypts all scan traffic

18. True or False: Running all vulnerability scans at maximum speed reduces the risk of detection.

True

False

19. Which information gathering technique passively collects data without directly contacting the target?

Port scanning

OSINT (Open Source Intelligence)

Vulnerability scanning

Network enumeration

20. What is the primary advantage of using fragmented packets during a vulnerability scan?

Increases scan speed

Evades IDS/IPS detection

Reduces bandwidth usage

Improves accuracy of results

PenTest+ V2 Scan Timing and Stealth Considerations Quiz

1. True or False: ACK scans are useful for mapping firewall rules and identifying filtered ports.

2.

What first name or nickname would you like us to use?

2. A ______ scan is useful for identifying stateless firewalls that do not track connection state.

3. Firewall evasion techniques during scanning may include which methods? (Select all that apply)

4. What is the main difference between a vulnerability scan and a penetration test?

5. True or False: Nessus and OpenVAS can both perform both credentialed and non-credentialed vulnerability scans.

6. Which of the following best describes 'banner grabbing'?

7. In information gathering, ______ analysis involves examining DNS records to identify subdomains and IP ranges.

8. Which scan type sends only SYN packets and observes responses without completing the TCP handshake?

9. What is a 'time-based evasion' technique in vulnerability scanning?

10. Which tool is commonly used for passive information gathering and OSINT collection?

11. Which scan timing template in Nmap is designed for stealth and takes significantly longer to complete?

12. A penetration tester uses decoy scans to ______ the actual source of the reconnaissance activity.

13. What is the primary purpose of scan rate limiting during a penetration test?

14. Which of the following is a passive information gathering technique? (Select all that apply)

15. In the context of vulnerability scanning, what does 'credentialed scanning' provide?

16. Which scanning method is most likely to trigger intrusion detection systems?

17. What does the idle scan technique accomplish in network reconnaissance?

18. True or False: Running all vulnerability scans at maximum speed reduces the risk of detection.

19. Which information gathering technique passively collects data without directly contacting the target?

20. What is the primary advantage of using fragmented packets during a vulnerability scan?