CEH Footprinting, Reconnaissance and Scanning — 30 Questions

Question 1

A penetration tester is attempting to evade an IDS/IPS while performing a port scan. They use the Nmap command: nmap -sS -f --data-length 20 -D RND:10 10.0.0.1. Which techniques are being employed to evade detection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Fragmentation, decoy, and using a random source IP. The explanation accurately identifies the three distinct evasion techniques from the Nmap command: fragmentation (-f), decoy scanning (-D RND:10), and packet data padding (--data-length 20). However, the explanation does not fully justify the marked correct option C, as option C fails to include 'packet data padding' and instead lists 'using a random source IP' which is either a consequence or rephrasing of the decoy technique, not a distinct third technique as identified by the command's flags.

Answer

Idle scan, fragmentation, and MAC address spoofing

Answer

Packet timing manipulation, decoy, and avoiding DNS resolution

Answer

Fragmentation, decoy, and source port spoofing

Question 2

Which THREE of the following are valid DNS record types that an attacker might query during reconnaissance to gather information about a target domain? (Select 3)

Accepted Answer

A (IPv4 address). The A record maps a domain name to an IPv4 address, which is fundamental for locating a target server. During reconnaissance, querying A records reveals the IP address of the target domain, enabling further scanning and attack planning. The NS (Name Server) record identifies the authoritative DNS servers for a domain, providing insight into the target's DNS infrastructure and potential points of attack or misconfiguration. The MX (Mail Exchange) record specifies the mail servers responsible for accepting email for a domain, which is crucial for identifying email infrastructure, potential phishing targets, or email server vulnerabilities. These are all standard DNS query types defined in RFC 1035 and are highly valuable for attackers during reconnaissance.

Answer

FTP (file transfer)

Answer

HTTP (hypertext transfer)

Question 3

A security analyst observes unusual outbound traffic from an internal host to an external IP on port 443. The analyst suspects a reverse shell where the internal host initiates an HTTPS connection to the attacker. Which Nmap script would be MOST useful to confirm the nature of this traffic if the analyst can run a scan on the internal host?

Accepted Answer

tls-nextprotoneg. tls-nextprotoneg is correct because it detects the TLS Next Protocol Negotiation (NPN) extension. Reverse shells often use NPN/ALPN to establish non-standard application-layer protocols over HTTPS to evade detection. If the analyst runs Nmap *from* the internal host *targeting the external IP*, this script can probe the external server to reveal if the TLS session it offers is attempting to negotiate a protocol other than standard HTTP, which would indicate a reverse shell command and control (C2) server.

Answer

smb-enum-shares

Answer

http-malware-host

Answer

ssh2-enum-algos

Question 4

A penetration tester runs `nmap -sS -sV -O -p- 192.168.1.10` and receives the following output snippet: 'PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4 80/tcp open http Apache httpd 2.4.6 443/tcp open ssl/http Apache httpd 2.4.6'. Which THREE pieces of information can the tester derive from this output? (Choose 3)

Accepted Answer

The -sV flag was used for version detection. The `-sV` flag in Nmap explicitly enables version detection, which probes open ports to determine the service and version information displayed in the output (e.g., 'OpenSSH 7.4', 'Apache httpd 2.4.6'). This directly supports option B. The output also explicitly states 'Apache httpd 2.4.6', confirming option C. However, the provided output snippet does not include any information about the target's operating system, making option E not derivable from the snippet.

Answer

The target has a vulnerability in OpenSSH 7.4

Answer

The target is vulnerable to the Heartbleed bug

Answer

The target is running a Linux-based operating system

Question 5

Which TWO of the following are valid port states that Nmap can report? (Select 2)

Accepted Answer

Open. Nmap reports 'Open' when a port responds to a probe (e.g., SYN, ACK, or connect scan) with a positive acknowledgment, indicating a service is actively listening. It reports 'Filtered' when packet filtering (e.g., a firewall) prevents Nmap's probes from reaching the port, making it impossible to determine if the port is open or closed. These are two of the six fundamental port states defined in Nmap's output, directly derived from TCP/IP protocol behavior during the scan.

Answer

Unknown

Answer

Secured

Answer

Blocked

Question 6

During a security assessment, a tester uses Netcat to connect to a target's SMTP port and receive the service banner. Which command would achieve this?

Accepted Answer

nc -v 25. The `nc 25` command establishes a TCP connection to the target's SMTP port. Upon connection, SMTP servers typically send a service banner (e.g., "220 smtp.example.com ESMTP"). Netcat, in client mode, prints all received data to standard output, thus displaying the banner. The `-v` (verbose) flag adds additional connection details and status messages, which can be helpful for a security assessment, but the banner itself would be displayed even without `-v`. Among the given options, D is the most appropriate choice as the other options are incorrect for the stated goal.

Answer

nc -z <target> 25

Answer

nc -l -p 25

Answer

nc -u <target> 25

Question 7

A penetration tester is conducting reconnaissance and wants to identify live hosts in a range without being detected. Which TWO techniques would be MOST appropriate? (Choose two.)

Accepted Answer

DNS query for reverse lookup. A DNS query for reverse lookup (PTR record) is a passive reconnaissance technique that queries DNS servers for hostnames associated with IP addresses. It does not send packets directly to the target hosts, making it difficult for intrusion detection systems (IDS) or firewalls to detect the probing activity. Passive OS fingerprinting involves analyzing existing network traffic (e.g., sniffing packets) to infer information about live hosts and their operating systems without sending any new probes or packets to the target. Both techniques allow a penetration tester to gather information about live hosts without generating network traffic that would alert defensive measures on the target network.

Answer

Ping sweep

Answer

ARP scan

Answer

TCP SYN scan

Question 8

A security analyst wants to perform banner grabbing on a web server without establishing a full TCP connection. Which tool would be MOST appropriate?

Accepted Answer

Wireshark. Wireshark is the only tool listed that can perform banner grabbing without establishing a full TCP connection because it operates passively by capturing network traffic. It can capture banners transmitted during existing sessions. Telnet, Nmap with -sT, and Netcat all require completing the TCP handshake to receive the banner, thus they do not meet the condition of 'without establishing a full TCP connection.'

Answer

Telnet

Answer

Nmap with -sT

Answer

Netcat

Question 9

Which THREE of the following are common countermeasures to prevent DNS zone transfers from being abused? (Choose THREE.)

Accepted Answer

Restrict zone transfers to only specific authorized secondary name servers. Restricting zone transfers to only specific authorized secondary name servers (Option B) is a fundamental access control measure that prevents unauthorized hosts from requesting a full copy of the DNS zone data, thereby mitigating information leakage during reconnaissance. Implementing split DNS (Option C) limits the information an external attacker can gain from a successful zone transfer by presenting different views of DNS data to internal and and external clients. Using Transaction Signatures (TSIG) (Option D) provides cryptographic authentication for zone transfer requests, ensuring that only trusted secondary servers with the shared secret key can perform transfers.

Answer

Enable DNS recursion on the name server

Answer

Configure the name server to allow zone transfers from any host

Question 10

Which THREE of the following are valid Nmap NSE scripts that could be used for service version detection or vulnerability scanning? (Choose THREE.)

Accepted Answer

ssl-heartbleed. The `ssl-heartbleed` NSE script (ssl-heartbleed.nse) specifically checks for the Heartbleed vulnerability (CVE-2014-0160) in OpenSSL implementations, making it a direct vulnerability scanning script. The `banner` script connects to a port and retrieves the service banner, which often contains service name and version information, thus serving for service version detection. The `http-sql-injection` script attempts to detect SQL injection vulnerabilities in HTTP services, making it a vulnerability scanning script. All three directly align with the question's criteria of service version detection or vulnerability scanning.

Answer

dns-zone-transfer

Answer

smb-os-discovery

Question 11

Which TWO of the following are examples of passive OS fingerprinting techniques? (Select 2)

Accepted Answer

Analyzing the initial TTL value of received IP packets. Passive OS fingerprinting involves observing network traffic without sending any packets to the target. Analyzing the initial TTL value of received IP packets (Option B) is a classic passive technique: different operating systems set specific default TTL values (e.g., Windows uses 128, Linux uses 64, Cisco IOS uses 255), allowing an attacker to infer the OS without direct interaction. Similarly, inspecting the TCP window size in SYN packets (Option D) is also a passive technique. Different operating systems advertise different default TCP window sizes when establishing connections, which can be observed by sniffing existing traffic without sending any new packets to the target. Options A, C, and E involve sending packets to the target, making them active fingerprinting techniques.

Answer

Performing a SYN scan on the target

Answer

Sending a series of TCP packets with different flags and analyzing responses

Answer

Using the telnet command to connect to port 80

Question 12

Which TWO of the following are common OSINT tools for passive reconnaissance? (Select 2)

Accepted Answer

theHarvester. theHarvester is a passive OSINT tool that gathers email addresses, subdomains, IPs, and virtual hosts from public sources like search engines (Google, Bing), PGP key servers, and the SHODAN database without sending any packets directly to the target. Maltego is also a passive OSINT tool that uses graphical link analysis to gather and connect information from various public sources (e.g., DNS records, social media, public databases) to map relationships between entities. Both tools align with passive reconnaissance, which relies on publicly available information rather than active probing.

Answer

Metasploit

Answer

hping3

Answer

Nmap

Question 13

Which THREE of the following are valid methods to prevent DNS zone transfer attacks? (Select 3)

Accepted Answer

Use TSIG (Transaction Signatures) for authentication. The explanation for option B is incorrect. Disabling recursive queries prevents a DNS server from performing lookups on behalf of external clients (preventing amplification attacks and general information leakage via recursion), but it does not prevent an authoritative server from responding to direct queries for its own zone or from performing zone transfers if configured to allow them. Zone transfers (AXFR/IXFR) are not recursive queries and are handled separately. Therefore, disabling recursion does not directly prevent or limit zone transfer attacks.

Answer

Increase the SOA refresh interval

Answer

Disable recursive queries for external hosts

Answer

Block all inbound traffic on UDP port 53

Question 14

Which THREE of the following are legitimate uses of the Shodan search engine in a security assessment? (Select 3)

Accepted Answer

Discovering internet-connected industrial control systems (ICS) with default passwords. Shodan is a search engine for internet-connected devices. It indexes banners from services like HTTP, SSH, and FTP, allowing security assessors to identify exposed industrial control systems (ICS) such as SCADA devices, and often revealing default configurations or weak security (Option B). Its ability to collect certificate information also allows for mapping SSL/TLS certificates to discover associated domains and subdomains (Option C). Fundamentally, Shodan's core function is to passively scan the internet and identify open ports and services on hosts within specified ranges, making it a powerful reconnaissance tool for understanding an organization's internet-facing attack surface (Option E). These are all legitimate reconnaissance uses in a security assessment, focusing on information gathering rather than active exploitation or social engineering.

Answer

Performing SQL injection on a web application

Answer

Sending phishing emails to employees of a target organization

Question 15

Which TWO OSINT tools are commonly used to gather email addresses and subdomains associated with a target domain? (Select 2)

Accepted Answer

theHarvester. theHarvester is a dedicated OSINT tool designed to gather email addresses, subdomains, IPs, and virtual hosts from public sources such as search engines (Google, Bing), PGP key servers, and the SHODAN database. It directly queries these sources to enumerate email addresses and subdomains associated with a target domain, making it a primary choice for passive reconnaissance. Maltego is a powerful graphical link analysis tool used for gathering and visualizing information from various sources, including email addresses and subdomains, by transforming data into entities and relationships. It can integrate with many data sources (transforms) to find connections and enumerate information related to a target domain.

Answer

Nmap

Answer

Nessus

Answer

Shodan

Question 16

A security analyst runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?

Accepted Answer

Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting. The `-sS` flag initiates a TCP SYN stealth scan, `-sV` enables service version detection, and `-O` attempts OS fingerprinting. The `-p 22,80,443,3389` limits the scan to those four ports, and the target `192.168.1.0/24` scans the entire Class C subnet. This combination performs a half-open scan on the specified ports, probes for application versions, and tries to identify the operating system of each live host.

Answer

Perform a full TCP connect scan with UDP service detection on all ports

Answer

Perform an aggressive scan of all open ports and enumerate SMB shares

Answer

Perform a UDP scan on the four specified ports and identify running services

Question 17

During a passive reconnaissance phase, a penetration tester uses a tool to gather email addresses, subdomains, and employee names associated with a target domain without directly interacting with the target's systems. Which tool is BEST suited for this purpose?

Accepted Answer

theHarvester. theHarvester is specifically designed for passive reconnaissance by querying public sources such as search engines (Google, Bing), PGP key servers, and the Shodan API to collect email addresses, subdomains, and employee names without sending any packets directly to the target's infrastructure. This aligns perfectly with the requirement of gathering OSINT data without direct interaction.

Answer

Nmap

Answer

Netcat

Answer

Wireshark

Question 18

A security analyst notices unusual outbound traffic from an internal server to a known malicious IP address on port 4444. The server is running a web application that was recently scanned using a vulnerability scanner. Which of the following is the MOST likely cause?

Accepted Answer

A vulnerability discovered during the scan was exploited, establishing a reverse shell connection to the attacker. Outbound traffic on port 4444 from an internal server to a known malicious IP is a classic indicator of a reverse shell connection. A reverse shell is a common post-exploitation technique where an attacker forces the victim server to connect back to their listener, often on high ports like 4444, bypassing inbound firewall rules. The timing after a vulnerability scan strongly suggests that a discovered vulnerability (e.g., command injection, RCE) was exploited to establish this shell.

Answer

The server is performing a DNS lookup to resolve the malicious IP address

Answer

The web application is sending log data to a SIEM system for analysis

Answer

The vulnerability scan caused a false positive and triggered a legitimate backup process

Question 19

During a penetration test, you execute the following command: dnsrecon -d example.com -t axfr. The output shows 'AXFR record received' followed by a list of all DNS records. What does this indicate about the target's DNS configuration?

Accepted Answer

The DNS server is vulnerable to zone transfer attacks, allowing unauthorized users to retrieve the entire zone file. The successful execution of `dnsrecon -d example.com -t axfr` and the receipt of an AXFR (full zone transfer) response indicates that the target DNS server is misconfigured to allow zone transfers from any host. A properly secured DNS server should restrict AXFR queries to only authorized secondary (slave) servers, typically by IP address or TSIG (Transaction Signature) keys. Since the command was run from an unauthorized client, this confirms a zone transfer vulnerability, allowing an attacker to retrieve the entire DNS zone file, which reveals all hostnames, IP addresses, and service records.

Answer

The DNS server is using DNSSEC to secure zone transfers

Answer

The DNS server is properly configured and only allows zone transfers to authorized secondary servers

Answer

The target uses a split-DNS configuration with internal and external views

Question 20

Which Google dork would a penetration tester use to find login pages of websites that have 'admin' in the URL?

Accepted Answer

inurl:"admin" inurl:"login". The Google dork `inurl:"admin" inurl:"login"` specifically searches for pages where both 'admin' and 'login' appear in the URL. This is a precise way to find login pages on administrative interfaces, as it targets URLs containing both terms, which is a common pattern for admin login portals.

Answer

site:admin login

Answer

filetype:pdf admin login

Answer

intitle:"login" inurl:admin