CEH Practice Test 17 — 15 Questions

Question 1

A penetration tester uses the following Nmap command: nmap -sS -O -p 1-1000 10.0.0.1. The output shows port 22 as open, and OS detection suggests 'Linux 2.6.x'. The tester then runs: nmap -sV -p 22 10.0.0.1. What additional information does the second scan provide?

Accepted Answer

It identifies the version of the SSH service running. The second scan uses the `-sV` flag, which enables version detection. Nmap probes the open port 22 (SSH) to determine the exact service version (e.g., OpenSSH 5.3p1). This is distinct from OS detection (`-O`), which guesses the operating system based on TCP/IP stack fingerprinting. The `-sV` scan provides granular service version information, not OS confirmation or firewall status.

Answer

It confirms the OS is Linux 2.6.x

Answer

It checks if the port is filtered by a firewall

Answer

It performs a UDP scan on port 22

Question 2

A penetration tester obtains password hashes from a Windows system. Which TWO methods would be most efficient for cracking NTLM hashes offline? (Choose two.)

Accepted Answer

Using Hashcat with a brute-force attack on GPU. Option D is correct because Hashcat, when used with a GPU, can perform massively parallel brute-force attacks against NTLM hashes, achieving billions of hash calculations per second. This makes it one of the most efficient tools for offline password cracking of NTLM hashes, especially when the password is not in a dictionary.

Answer

Using RainbowCrack with precomputed rainbow tables for NTLM

Answer

Performing an online brute-force against the SAM database

Answer

Using Ophcrack with rainbow tables for NTLM

Question 3

During a security assessment, you execute: dnsenum --enum example.com. The tool returns results including the nameservers (NS), mail servers (MX), and performs a zone transfer attempt. The zone transfer fails. What is the MOST likely reason for the failure?

Accepted Answer

The DNS server is configured to deny zone transfers from unauthorized hosts. Option C is correct because DNS zone transfers (AXFR) are typically restricted by default on authoritative DNS servers to prevent unauthorized disclosure of the entire zone file. The `dnsenum` tool attempts an AXFR query over TCP port 53, and the failure indicates the server explicitly denied the request, which is a standard security configuration per RFC 5936.

Answer

The DNS server is not running

Answer

The zone transfer requires TCP port 443

Answer

The domain does not exist

Question 4

Which THREE of the following are correct statements about DNS zone transfers?

Accepted Answer

A successful zone transfer reveals all DNS records for the domain. A successful DNS zone transfer (AXFR) returns the complete zone file, which contains all DNS records for the domain, including A, AAAA, MX, CNAME, NS, and TXT records. This is why it is a critical information-gathering step during reconnaissance.

Answer

Zone transfers are encrypted by default

Answer

Zone transfers use UDP port 53

Question 5

A penetration tester is conducting reconnaissance and wants to identify live hosts in a range without being detected. Which TWO techniques would be MOST appropriate? (Choose two.)

Accepted Answer

DNS query for reverse lookup. A DNS query for reverse lookup (PTR record) is a passive reconnaissance technique that queries DNS servers for hostnames associated with IP addresses. It does not send packets directly to the target hosts, making it difficult for intrusion detection systems (IDS) or firewalls to detect the probing activity. This aligns with the goal of identifying live hosts without generating network traffic that would alert defensive measures.

Answer

Ping sweep

Answer

ARP scan

Answer

TCP SYN scan

Question 6

A security team detects unusual outbound traffic from a host that appears to be a reverse shell. Which of the following Nmap features would be MOST effective for identifying the service running on the listening port of the command-and-control server?

Accepted Answer

Service version detection using the -sV flag. Option D is correct because the -sV flag instructs Nmap to perform service version detection by probing open ports and analyzing the responses to determine the exact application and version running on the listening port. In a reverse shell scenario, identifying the service (e.g., a specific SSH, HTTP, or custom listener) on the C2 server is critical for understanding the attack vector and planning remediation.

Answer

UDP scan using the -sU flag

Answer

Nmap Scripting Engine (NSE) with the http-enum script

Answer

OS fingerprinting using the -O flag

Question 7

A security analyst runs the Nmap command: nmap -sI 192.168.1.50 -p 80 10.0.0.1. The scan completes, but the target shows no open ports. What is the MOST likely explanation?

Accepted Answer

The zombie host is not truly idle, causing false results. The -sI flag in Nmap performs an idle scan, which relies on a zombie host (192.168.1.50) with a globally predictable IP ID sequence to probe the target. If the zombie host is not truly idle—meaning it is sending or receiving other traffic during the scan—its IP ID values will increment unpredictably, corrupting the side-channel analysis and causing Nmap to report all ports as filtered or closed. This is the most likely reason for the false 'no open ports' result.

Answer

The analyst used the wrong port number

Answer

The target has a firewall blocking the decoy packets

Answer

The target host is offline

Question 8

Which Nmap flag is used to perform a TCP SYN scan without completing the three-way handshake?

Accepted Answer

-sS. The -sS flag instructs Nmap to perform a TCP SYN scan, which sends a SYN packet to the target port and, upon receiving a SYN/ACK response, sends an RST packet instead of completing the three-way handshake with an ACK. This allows the scanner to determine port states without establishing a full TCP connection, making it faster and less detectable than a full connect scan.

Answer

-sT

Answer

-sU

Answer

-sA

Question 9

A security analyst wants to gather information about a target domain using publicly available sources without directly interacting with the target’s systems. Which type of reconnaissance is being performed?

Accepted Answer

Passive reconnaissance. Passive reconnaissance involves collecting information about a target from publicly available sources without sending any packets or making direct contact with the target's systems. This approach relies on open-source intelligence (OSINT) such as WHOIS records, DNS lookups, search engines, and social media, ensuring no footprint is left on the target's network.

Answer

Vulnerability scanning

Answer

Social engineering

Answer

Active reconnaissance

Question 10

A security analyst wants to discover all DNS records associated with a domain without triggering a full zone transfer. Which tool is BEST suited for this task?

Accepted Answer

dnsrecon. D (dnsrecon) is correct because it is a dedicated DNS enumeration tool that performs multiple types of DNS record queries (A, AAAA, CNAME, MX, NS, SOA, SRV, TXT, etc.) using techniques like brute‑forcing subdomains and performing SRV record enumeration, all without attempting a full zone transfer (AXFR). It is specifically designed for reconnaissance and can discover hidden or non‑obvious DNS records efficiently.

Answer

theHarvester

Answer

dig

Answer

nslookup

Question 11

A penetration tester uses theHarvester to gather information about a target domain. Which of the following data types is theHarvester PRIMARILY designed to collect?

Accepted Answer

Email addresses and subdomains. theHarvester is an open-source intelligence (OSINT) tool designed to perform passive reconnaissance by querying public sources such as search engines (Google, Bing), PGP key servers, and the Shodan API. Its primary function is to collect email addresses, subdomains, IP addresses, and virtual hosts associated with a target domain, aiding in the footprinting phase of a penetration test.

Answer

Live network traffic captures

Answer

Passwords hashes

Answer

Vulnerability scan results

Question 12

During a reconnaissance phase, a penetration tester uses Shodan to search for devices with a specific open port. Which of the following BEST describes what Shodan provides beyond a simple port scan?

Accepted Answer

Banner information and service metadata from internet-connected devices. Shodan is a search engine for internet-connected devices that actively probes IP addresses and collects banner information—the metadata that services (e.g., HTTP, SSH, FTP) return upon connection. This includes server headers, version strings, default credentials, and other service fingerprints, which goes far beyond a simple port scan that only reports whether a port is open or closed.

Answer

Real-time network traffic analysis

Answer

Passive DNS records and domain registration details

Answer

Historical vulnerability data for each device

Question 13

Which TWO techniques are considered active reconnaissance? (Choose TWO.)

Accepted Answer

Port scanning with Nmap. Port scanning with Nmap (Option C) is active reconnaissance because it sends crafted packets (e.g., TCP SYN, UDP probes) directly to target systems and analyzes the responses to determine open ports, running services, and operating system details. Banner grabbing with Netcat (Option D) is also active reconnaissance as it establishes a TCP connection to a target service (e.g., HTTP, FTP) and reads the service banner, which involves direct interaction with the target. Both techniques generate detectable network traffic and can be logged by intrusion detection systems.

Answer

Using Google dorking to find exposed files

Answer

Querying Shodan for exposed devices

Answer

Performing a WHOIS lookup

Question 14

An incident responder analyzes logs and finds repeated failed zone transfer attempts from an external IP. The zone transfer requests are targeting the domain example.com. Which DNS record type, if misconfigured, would allow this attack to succeed?

Accepted Answer

AXFR. B is correct because AXFR (Asynchronous Full Transfer) is the DNS zone transfer protocol that, if misconfigured (i.e., allowing unrestricted AXFR queries from any IP), permits an external attacker to request and receive the entire DNS zone file for example.com. The repeated failed attempts indicate the attacker is probing for an open AXFR service, which would succeed if the DNS server is configured to allow zone transfers to any host without restriction.

Answer

NS records

Answer

MX records

Answer

SOA records

Question 15

A security analyst is asked to perform a fast scan of a large network (e.g., /16 subnet) to identify live hosts. Which tool is MOST suitable for this task due to its high speed?

Accepted Answer

Masscan. Masscan is the most suitable tool for this task because it is designed specifically for high-speed scanning of large address spaces, such as a /16 subnet (65,536 hosts). It uses asynchronous transmission and can send packets at rates exceeding 10 million packets per second, making it significantly faster than Nmap for raw host discovery across massive ranges.

Answer

hping3

Answer

Nmap

Answer

Wireshark