312-50 Question 365
Single answer▪ Evasion TechniquesDuring an authorized internal security assessment, you need to identify live hosts in a segmented network without triggering the SOC's perimeter IDS signatures that are known to alert on ICMP echo requests and full TCP connect scans. Firewall rules permit traffic to common server ports, and you already know many Windows servers in the target subnet expose SMB. Which approach is the most appropriate to discover hosts while reducing the chance of detection?
- A
Run an ICMP echo sweep across the subnet using standard ping requests
- B
Use a TCP SYN ping against port 445 on the target subnet to identify responsive hosts
- C
Perform a full TCP connect scan (-sT) of all 65,535 ports on each host
- D
Use a UDP flood against port 161 to force SNMP responses from live systems
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use a TCP SYN ping against a likely open port such as 445 when ICMP-based discovery is expected to trigger detection. In environments where defenders monitor ping sweeps and obvious scan patterns, ethical hackers often adapt host discovery to blend with normal permitted traffic. Nmap documentation distinguishes host discovery methods such as ICMP probes and TCP SYN ping (-PS), and explains that TCP-based discovery can be useful when ICMP is blocked or monitored. A SYN ping is not invisible, but it is generally more appropriate than ICMP echo sweeps or full TCP connect scans for this scenario. Full connect scans create completed connections and tend to generate more logs, while flooding techniques are not acceptable evasion methods in a controlled professional engagement. Best practice is to select the least intrusive method that satisfies the objective and remains within authorization and rules of engagement.
- A. Incorrect.
Incorrect. A standard ICMP echo sweep is one of the most commonly detected host discovery methods, and the scenario explicitly states that the IDS alerts on ICMP echo requests. While ping sweeps can be effective in permissive environments, they are not the best choice when evasion is required.
- B. Correct.
Correct. A TCP SYN ping to port 445 is a practical host discovery method when ICMP is monitored or filtered and when you know SMB is commonly exposed on Windows systems. SYN-based host discovery sends a SYN packet and infers host availability from SYN/ACK or RST responses without completing a full TCP connection, which is generally less noisy than a full connect scan. This aligns with real-world evasion techniques where testers use allowed application ports for discovery rather than obvious ICMP probes.
- C. Incorrect.
Incorrect. A full TCP connect scan is substantially noisier than host discovery with SYN probes and is more likely to be logged by hosts and detected by security monitoring tools. It also goes far beyond the stated objective of simply identifying live hosts. Choosing this option reflects the misconception that more scanning produces better stealth; in practice, excessive scanning increases detection likelihood.
- D. Incorrect.
Incorrect. A UDP flood is not a legitimate stealth host discovery technique and would likely be disruptive, generate alerts, and potentially violate rules of engagement. Even targeted UDP probing can be unreliable for host discovery because many UDP services do not respond consistently, and a flood is especially inappropriate in a professional assessment.