GIAC GPEN Exam - Topic 7 Question 69 Discussion

Actual exam question for GIAC's GPEN exam

Question #: 69
Topic #: 7

You work as a Penetration Tester for the Infosec Inc. Your company takes the projects of security auditing. Recently, your company has assigned you a project to test the security of the we-aresecure. com Web site. For this, you want to perform the idle scan so that you can get the ports open in the we-are-secure.com server. You are using Hping tool to perform the idle scan by using a zombie computer. While scanning, you notice that every IPID is being incremented on every query, regardless whether the ports are open or close. Sometimes, IPID is being incremented by more than one value. What may be the reason?

AThe zombie computer is the system interacting with some other system besides your comp uter.

BThe firewall is blocking the scanning process.

CThe zombie computer is not connected to the we-are-secure.com Web server.

DHping does not perform idle scanning.

Show Suggested Answer

Suggested Answer: C

by Herminia at Mar 20, 2025, 10:22 PM

Limited Time Offer

25%

Off

Get Premium GPEN Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Jacquline

5 months ago

Not sure about that, could be a misconfiguration too.

upvoted 0 times

...

Lorrie

5 months ago

Wait, Hping can't do idle scans? That's surprising!

upvoted 0 times

...

Tony

6 months ago

I think it's definitely the firewall messing things up.

upvoted 0 times

...

Tandra

6 months ago

Sounds like the zombie's busy with other traffic.

upvoted 0 times

...

Adelaide

6 months ago

I agree, the zombie must be interacting with something else.

upvoted 0 times

...

My

6 months ago

I thought Hping was capable of idle scanning, so I doubt option D is correct. But I could be mistaken about its capabilities.

upvoted 0 times

...

Ellsworth

6 months ago

I practiced idle scans before, and I recall that the zombie needs to be connected to the target for it to work properly. So, option C could make sense too.

upvoted 0 times

...

Gregoria

7 months ago

I'm not entirely sure, but I think firewalls can sometimes interfere with scans. Maybe option B is a possibility?

upvoted 0 times

...

Lacresha

7 months ago

I remember reading that if the zombie is interacting with other systems, it could cause the IPID to increment unexpectedly. So, option A might be the right choice.

upvoted 0 times

...

Lorrie

7 months ago

Hmm, I'm not sure about that last option. Hping is a pretty powerful tool, so I doubt it wouldn't be able to perform an idle scan. I'll have to double-check that.

upvoted 0 times

...

Cassie

7 months ago

Ah, I see. If the zombie computer isn't properly connected to the target server, that could definitely lead to the IPID issue. Good point to consider.

upvoted 0 times

...

Cora

8 months ago

Wait, I'm a bit confused. Is the firewall really a possible reason here? I thought the idle scan was designed to bypass firewalls.

upvoted 0 times

...

Yong

8 months ago

Okay, let's see. The zombie computer interacting with another system could definitely cause the IPID to increment in unexpected ways. I'll keep that in mind.

upvoted 0 times

...

Rebecka

8 months ago

Hmm, this seems like a tricky one. I'll need to think carefully about the possible reasons for the IPID behavior.

upvoted 0 times

...

Lynelle

1 year ago

Zombie computer, huh? Sounds like this penetration test is more like a haunted house than an audit.

upvoted 0 times

...

Yuette

1 year ago

Hping not doing idle scanning? That's like saying a screwdriver can't screw in screws. I'm pretty sure that's not the issue here.

upvoted 0 times

Amira

11 months ago

B) The firewall is blocking the scanning process.

upvoted 0 times

...

Tammara

12 months ago

A) The zombie computer is the system interacting with some other system besides your computer.

upvoted 0 times

...

Theresia

12 months ago

B) The firewall is blocking the scanning process.

upvoted 0 times

...

Diane

12 months ago

A) The zombie computer is the system interacting with some other system besides your computer.

upvoted 0 times

...

Maryann

1 year ago

Wait, so the zombie computer isn't even connected to the target server? That's a pretty big problem for the idle scan to work. Gotta be option C.

upvoted 0 times

Douglass

11 months ago

Looks like we need to make sure the zombie computer is properly connected to the we-are-secure.com server for the idle scan to be effective.

upvoted 0 times

...

Rosalia

12 months ago

That's true, option C seems to be the most likely reason for the IPID incrementing regardless of open ports.

upvoted 0 times

...

Rhea

1 year ago

Yeah, if the zombie computer isn't connected to the target server, then the idle scan won't work.

upvoted 0 times

...

Izetta

1 year ago

Nah, the firewall blocking the scan wouldn't cause the IPID to increment in that way. I think you're on the right track with the zombie computer being the issue.

upvoted 0 times

Wenona

12 months ago

A) The zombie computer is the system interacting with some other system besides your computer.

upvoted 0 times

...

Bette

12 months ago

B) The firewall is blocking the scanning process.

upvoted 0 times

...

Lettie

12 months ago

A) The zombie computer is the system interacting with some other system besides your computer.

upvoted 0 times

...

Felix

1 year ago

But what if the firewall is blocking the scanning process? Could that also be a reason?

upvoted 0 times

...

Charlette

1 year ago

Hmm, if the IPID is incrementing even for closed ports, it sounds like the zombie computer is interacting with something else besides the target server. I'd go with option A.

upvoted 0 times