If there is an Intrusion Detection System (IDS) in intranet, which port scanning technique cannot be used?
A.
Spoof Scan
B.
TCP Connect scan
C.
TCP SYN
D.
Idle Scan
Get 50% Discount on All Your Purchases
at PrepAway.com - Latest Exam Questions
This is ONE TIME OFFER
50%
Correct answer is B:
— TCP Full Connect. This mode makes a full connection to the target’s TCP ports and can save any data or banners returned from the target. This mode is the most accurate for determining TCP services, but it is also easily recognized by Intrusion Detection Systems (IDS).
TCP SYN Half Open. This mode sends out a SYN packet to the target port and listens for the appropriate response. Open ports respond with a SYN|ACK and closed ports respond with ACK| RST or RST. This mode is less likely to be noted by IDS, but since the connection is never fully completed, it cannot gather data or banner information.
TCP SYN is not a Port Scan.
Yes it is when the option -sS is used, but there is a TCP SYN ping for host discovery also when the -PS option is used.
The answer is C I believe as for the reasons in the first comment, TCP Connect scan is the -sT option, also known as a full open scan. -sS is known as a stealth scan, so the name would imply also its better at bypassing detection.
Correct answer is B I believe.