Study. uk . com
  1. Home
  2. All questions
  3. Question 389

CISSP study material · question 389 of 500

A tester plans to rely on unusual scan types to slip past the client's perimeter filtering. What does SP 800-115 caution?

  1. Alternate scan types work only against stateless packet filters.
  2. Alternate scan types are prohibited by the rules of engagement template.
  3. Alternate scan types cannot detect open ports, only closed ones.
  4. Many firewalls recognise and block alternate scan types, so evasion often fails in practice.
Show the answer

Answer: D. Many firewalls recognise and block alternate scan types, so evasion often fails in practice.

SP 800-115 notes that many firewalls can recognise and block various alternate scan types, so testers may not be able to use them to evade firewalls in many environments.

Source: NIST SP 800-115 (NIST) — SP 800-115 > 4.2 Network Port and Service Identification

Challenge yourself on this topic → Study as cards