CEH Footprinting, Reconnaissance and Scanning — 10 Questions

Question 1

A penetration tester is attempting to evade an IDS/IPS while performing a port scan. They use the Nmap command: nmap -sS -f --data-length 20 -D RND:10 10.0.0.1. Which techniques are being employed to evade detection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Fragmentation, decoy, and using a random source IP. The explanation accurately identifies the three distinct evasion techniques from the Nmap command: fragmentation (-f), decoy scanning (-D RND:10), and packet data padding (--data-length 20). However, the explanation does not fully justify the marked correct option C, as option C fails to include 'packet data padding' and instead lists 'using a random source IP' which is either a consequence or rephrasing of the decoy technique, not a distinct third technique as identified by the command's flags.

Answer

Idle scan, fragmentation, and MAC address spoofing

Answer

Packet timing manipulation, decoy, and avoiding DNS resolution

Answer

Fragmentation, decoy, and source port spoofing

Question 2

Which THREE of the following are valid DNS record types that an attacker might query during reconnaissance to gather information about a target domain? (Select 3)

Accepted Answer

A (IPv4 address). The A record maps a domain name to an IPv4 address, which is fundamental for locating a target server. During reconnaissance, querying A records reveals the IP address of the target domain, enabling further scanning and attack planning. The NS (Name Server) record identifies the authoritative DNS servers for a domain, providing insight into the target's DNS infrastructure and potential points of attack or misconfiguration. The MX (Mail Exchange) record specifies the mail servers responsible for accepting email for a domain, which is crucial for identifying email infrastructure, potential phishing targets, or email server vulnerabilities. These are all standard DNS query types defined in RFC 1035 and are highly valuable for attackers during reconnaissance.

Answer

FTP (file transfer)

Answer

HTTP (hypertext transfer)

Question 3

A security analyst observes unusual outbound traffic from an internal host to an external IP on port 443. The analyst suspects a reverse shell where the internal host initiates an HTTPS connection to the attacker. Which Nmap script would be MOST useful to confirm the nature of this traffic if the analyst can run a scan on the internal host?

Accepted Answer

tls-nextprotoneg. tls-nextprotoneg is correct because it detects the TLS Next Protocol Negotiation (NPN) extension. Reverse shells often use NPN/ALPN to establish non-standard application-layer protocols over HTTPS to evade detection. If the analyst runs Nmap *from* the internal host *targeting the external IP*, this script can probe the external server to reveal if the TLS session it offers is attempting to negotiate a protocol other than standard HTTP, which would indicate a reverse shell command and control (C2) server.

Answer

smb-enum-shares

Answer

http-malware-host

Answer

ssh2-enum-algos

Question 4

A penetration tester runs `nmap -sS -sV -O -p- 192.168.1.10` and receives the following output snippet: 'PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4 80/tcp open http Apache httpd 2.4.6 443/tcp open ssl/http Apache httpd 2.4.6'. Which THREE pieces of information can the tester derive from this output? (Choose 3)

Accepted Answer

The -sV flag was used for version detection. The `-sV` flag in Nmap explicitly enables version detection, which probes open ports to determine the service and version information displayed in the output (e.g., 'OpenSSH 7.4', 'Apache httpd 2.4.6'). This directly supports option B. The output also explicitly states 'Apache httpd 2.4.6', confirming option C. However, the provided output snippet does not include any information about the target's operating system, making option E not derivable from the snippet.

Answer

The target has a vulnerability in OpenSSH 7.4

Answer

The target is vulnerable to the Heartbleed bug

Answer

The target is running a Linux-based operating system

Question 5

Which TWO of the following are valid port states that Nmap can report? (Select 2)

Accepted Answer

Open. Nmap reports 'Open' when a port responds to a probe (e.g., SYN, ACK, or connect scan) with a positive acknowledgment, indicating a service is actively listening. It reports 'Filtered' when packet filtering (e.g., a firewall) prevents Nmap's probes from reaching the port, making it impossible to determine if the port is open or closed. These are two of the six fundamental port states defined in Nmap's output, directly derived from TCP/IP protocol behavior during the scan.

Answer

Unknown

Answer

Secured

Answer

Blocked

Question 6

During a security assessment, a tester uses Netcat to connect to a target's SMTP port and receive the service banner. Which command would achieve this?

Accepted Answer

nc -v 25. The `nc 25` command establishes a TCP connection to the target's SMTP port. Upon connection, SMTP servers typically send a service banner (e.g., "220 smtp.example.com ESMTP"). Netcat, in client mode, prints all received data to standard output, thus displaying the banner. The `-v` (verbose) flag adds additional connection details and status messages, which can be helpful for a security assessment, but the banner itself would be displayed even without `-v`. Among the given options, D is the most appropriate choice as the other options are incorrect for the stated goal.

Answer

nc -z <target> 25

Answer

nc -l -p 25

Answer

nc -u <target> 25

Question 7

A penetration tester is conducting reconnaissance and wants to identify live hosts in a range without being detected. Which TWO techniques would be MOST appropriate? (Choose two.)

Accepted Answer

DNS query for reverse lookup. A DNS query for reverse lookup (PTR record) is a passive reconnaissance technique that queries DNS servers for hostnames associated with IP addresses. It does not send packets directly to the target hosts, making it difficult for intrusion detection systems (IDS) or firewalls to detect the probing activity. Passive OS fingerprinting involves analyzing existing network traffic (e.g., sniffing packets) to infer information about live hosts and their operating systems without sending any new probes or packets to the target. Both techniques allow a penetration tester to gather information about live hosts without generating network traffic that would alert defensive measures on the target network.

Answer

Ping sweep

Answer

ARP scan

Answer

TCP SYN scan

Question 8

A security analyst wants to perform banner grabbing on a web server without establishing a full TCP connection. Which tool would be MOST appropriate?

Accepted Answer

Wireshark. Wireshark is the only tool listed that can perform banner grabbing without establishing a full TCP connection because it operates passively by capturing network traffic. It can capture banners transmitted during existing sessions. Telnet, Nmap with -sT, and Netcat all require completing the TCP handshake to receive the banner, thus they do not meet the condition of 'without establishing a full TCP connection.'

Answer

Telnet

Answer

Nmap with -sT

Answer

Netcat

Question 9

Which THREE of the following are common countermeasures to prevent DNS zone transfers from being abused? (Choose THREE.)

Accepted Answer

Restrict zone transfers to only specific authorized secondary name servers. Restricting zone transfers to only specific authorized secondary name servers (Option B) is a fundamental access control measure that prevents unauthorized hosts from requesting a full copy of the DNS zone data, thereby mitigating information leakage during reconnaissance. Implementing split DNS (Option C) limits the information an external attacker can gain from a successful zone transfer by presenting different views of DNS data to internal and and external clients. Using Transaction Signatures (TSIG) (Option D) provides cryptographic authentication for zone transfer requests, ensuring that only trusted secondary servers with the shared secret key can perform transfers.

Answer

Enable DNS recursion on the name server

Answer

Configure the name server to allow zone transfers from any host

Question 10

Which THREE of the following are valid Nmap NSE scripts that could be used for service version detection or vulnerability scanning? (Choose THREE.)

Accepted Answer

ssl-heartbleed. The `ssl-heartbleed` NSE script (ssl-heartbleed.nse) specifically checks for the Heartbleed vulnerability (CVE-2014-0160) in OpenSSL implementations, making it a direct vulnerability scanning script. The `banner` script connects to a port and retrieves the service banner, which often contains service name and version information, thus serving for service version detection. The `http-sql-injection` script attempts to detect SQL injection vulnerabilities in HTTP services, making it a vulnerability scanning script. All three directly align with the question's criteria of service version detection or vulnerability scanning.

Answer

dns-zone-transfer

Answer

smb-os-discovery