312-50 Question 78
Select 2▪ Scanning Beyond IDS and FirewallDuring an authorized external assessment, you are asked to identify live hosts in a client DMZ without triggering the perimeter IDS. The client tells you that ICMP echo requests are blocked at the firewall, and previous SYN scans generated multiple IDS alerts. You want to perform host discovery in a way that is more likely to blend in with normal traffic while still revealing systems that are up. Which TWO approaches are most appropriate?
- A
Use TCP ACK ping probes to common allowed ports such as 80 and 443
- B
Use ARP requests across the Internet-facing segment from your external test system
- C
Use UDP ping probes to likely permitted services such as DNS on port 53
- D
Use a TCP connect scan with full three-way handshakes against every port on each target
Show answer and explanation
Correct answers: A, C
Explanation
When scanning beyond IDS and firewall controls, the goal is often to identify live hosts using probes that can traverse filtering rules and generate less obvious signatures than standard ICMP echo or repeated SYN scans. In this scenario, TCP ACK probes to commonly allowed ports and UDP probes to likely permitted services are both practical techniques. Nmap documentation supports multiple host discovery methods such as TCP ACK ping (-PA), TCP SYN ping (-PS), UDP ping (-PU), and others specifically for environments where ICMP is filtered. ARP discovery is highly effective, but only on the local network segment because ARP is not routable. A full TCP connect scan is generally more conspicuous and better suited for port scanning than stealthier host discovery. Best practice in authorized assessments is to select discovery methods that match known firewall allowances and minimize unnecessary noise while remaining within the rules of engagement.
- A. Correct.
Correct. TCP ACK ping can be useful for host discovery when ICMP is filtered and when you want to probe through firewalls using traffic patterns that may appear less suspicious than repeated SYN probes. Tools such as Nmap support ACK-based host discovery, and responses like RST packets can indicate that a host is alive even if the target port is not open. This is a common technique for scanning beyond simple ICMP restrictions.
- B. Incorrect.
Incorrect. ARP-based discovery is effective only on the local broadcast domain. ARP is not routed across the Internet, so an external tester cannot use ARP requests to discover hosts in a remote DMZ segment through the client's perimeter firewall. This option reflects a common misunderstanding between local-layer discovery and routed network reconnaissance.
- C. Correct.
Correct. UDP ping to services that are commonly allowed through firewalls, such as DNS on port 53, is a practical way to discover live hosts when ICMP is blocked. Even if the service is closed, an ICMP port unreachable response or a valid UDP reply can reveal that the host exists. This approach aligns with real-world evasion-minded discovery when only selected protocols are permitted.
- D. Incorrect.
Incorrect. A full TCP connect scan establishes complete connections and is typically noisier than lighter-weight discovery methods. It is more likely to be logged by the target host and detected by IDS/IPS compared with targeted ACK or UDP-based host discovery. It also goes beyond simple host discovery by actively attempting full connections across many ports, increasing visibility.