Exam 312-50 topic 4 question 19 discussion

Scanning using fragmented IP packets?

some ids and ips have the ability to connect the fragmented packets and hence couldnt be the answer. So option b is correct

it cant be D cos A is also used to bypass FW.

While the question says the pen tester is trying to scan the internal network from the internet (let's assume static nat or something), then this is the correct answer: https://nmap.org/book/man-bypass-firewalls-ids.html -f (fragment packets); --mtu (using the specified MTU) The -f option causes the requested scan (including ping scans) to use tiny fragmented IP packets. The idea is to split up the TCP header over several packets to make it harder for packet filters, intrusion detection systems, and other annoyances to detect what you are doing

IP fragmentation scan is a method to attempt evasion of IDS

Scanning using fragmented IP packets.

Scanning using fragmented IP packets.

Correct answer is D. Scanning using fragmented IP packets

B. Tunneling scan over SSH