CEH Footprinting, Reconnaissance and Scanning — All Questions With Answers

Question 1

A penetration tester is attempting to evade an IDS/IPS while performing a port scan. They use the Nmap command: nmap -sS -f --data-length 20 -D RND:10 10.0.0.1. Which techniques are being employed to evade detection?

Accepted Answer

Fragmentation, decoy, and using a random source IP. The explanation accurately identifies the three distinct evasion techniques from the Nmap command: fragmentation (-f), decoy scanning (-D RND:10), and packet data padding (--data-length 20). However, the explanation does not fully justify the marked correct option C, as option C fails to include 'packet data padding' and instead lists 'using a random source IP' which is either a consequence or rephrasing of the decoy technique, not a distinct third technique as identified by the command's flags.

Answer

Idle scan, fragmentation, and MAC address spoofing

Answer

Packet timing manipulation, decoy, and avoiding DNS resolution

Answer

Fragmentation, decoy, and source port spoofing

Question 2

A security analyst observes unusual outbound traffic from an internal host to an external IP on port 443. The analyst suspects a reverse shell where the internal host initiates an HTTPS connection to the attacker. Which Nmap script would be MOST useful to confirm the nature of this traffic if the analyst can run a scan on the internal host?

Accepted Answer

tls-nextprotoneg. tls-nextprotoneg is correct because it detects the TLS Next Protocol Negotiation (NPN) extension. Reverse shells often use NPN/ALPN to establish non-standard application-layer protocols over HTTPS to evade detection. If the analyst runs Nmap *from* the internal host *targeting the external IP*, this script can probe the external server to reveal if the TLS session it offers is attempting to negotiate a protocol other than standard HTTP, which would indicate a reverse shell command and control (C2) server.

Answer

smb-enum-shares

Answer

http-malware-host

Answer

ssh2-enum-algos

Question 3

A penetration tester runs `nmap -sS -sV -O -p- 192.168.1.10` and receives the following output snippet: 'PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4 80/tcp open http Apache httpd 2.4.6 443/tcp open ssl/http Apache httpd 2.4.6'. Which THREE pieces of information can the tester derive from this output? (Choose 3)

Accepted Answer

The -sV flag was used for version detection. Option B is correct because the -sV flag in the nmap command explicitly enables version detection, which is exactly what produced the VERSION column showing OpenSSH 7.4 and Apache httpd 2.4.6. Option C is correct because the output directly lists 'Apache httpd 2.4.6' for ports 80/tcp and 443/tcp, so the tester can read the Apache version straight from the scan results. Option A is incorrect because knowing the OpenSSH version does not by itself confirm a vulnerability; further research or a vulnerability scan would be needed. Option D is incorrect because Heartbleed affects specific OpenSSL versions, and the output shows Apache httpd, not the underlying OpenSSL version. Option E is incorrect because -O performs OS fingerprinting but the snippet provided does not include any OS detection results, so no Linux determination can be made from this output alone.

Answer

The target has a vulnerability in OpenSSH 7.4

Answer

The target is vulnerable to the Heartbleed bug

Answer

The target is running a Linux-based operating system

Question 4

A security analyst observes that an Nmap SYN scan against a target network returns all ports as 'filtered'. The analyst suspects an IDS/IPS is dropping inbound SYN packets. Which Nmap technique would MOST likely bypass this detection while still identifying open ports?

Accepted Answer

Enable IP fragmentation with the -f flag. When an IDS/IPS drops inbound SYN packets, a standard SYN scan (-sS) is detected because the probe packets are easily recognized. Enabling IP fragmentation with the -f flag splits the TCP header across multiple fragments, making it harder for the IDS/IPS to reassemble and inspect the full packet, thus potentially bypassing the filter while still allowing Nmap to determine open ports based on responses.

Answer

Use the -sU flag for UDP scanning

Answer

Use the -sT flag for a TCP connect scan

Answer

Increase scanning speed with -T5

Question 5

A security analyst runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?

Accepted Answer

Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting. The command `nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24` performs a TCP SYN scan (`-sS`) on only the four specified ports, enables service version detection (`-sV`), and attempts OS fingerprinting (`-O`). This is a stealthy half-open scan that does not complete the TCP three-way handshake, combined with banner grabbing and OS detection, limited to the given port list.

Answer

Perform an aggressive scan of all open ports and enumerate SMB shares

Answer

Perform a UDP scan on the four specified ports and identify running services

Answer

Perform a full TCP connect scan with UDP service detection on all ports

Question 6

Which TWO of the following are passive reconnaissance techniques? (Select 2)

Accepted Answer

Performing a WHOIS lookup. A WHOIS lookup queries public databases (e.g., whois.arin.net) to retrieve registration details for domains or IP blocks, such as registrar, creation date, and administrative contacts. This is passive because it relies on publicly available information without sending any packets directly to the target system. The CEH defines passive reconnaissance as gathering data without interacting with the target's network or services.

Answer

Banner grabbing with Netcat

Answer

Running a TCP SYN scan with Nmap

Answer

Performing a ping sweep

Question 7

During a security assessment, a tester uses Netcat to connect to a target's SMTP port and receive the service banner. Which command would achieve this?

Accepted Answer

nc -v 25. The `nc 25` command establishes a TCP connection to the target's SMTP port. Upon connection, SMTP servers typically send a service banner (e.g., "220 smtp.example.com ESMTP"). Netcat, in client mode, prints all received data to standard output, thus displaying the banner. The `-v` (verbose) flag adds additional connection details and status messages, which can be helpful for a security assessment, but the banner itself would be displayed even without `-v`. Among the given options, D is the most appropriate choice as the other options are incorrect for the stated goal.

Answer

nc -z <target> 25

Answer

nc -l -p 25

Answer

nc -u <target> 25

Question 8

A penetration tester is conducting reconnaissance and wants to identify live hosts in a range without being detected. Which TWO techniques would be MOST appropriate? (Choose two.)

Accepted Answer

DNS query for reverse lookup. Option C (DNS query for reverse lookup) is correct because querying PTR records through normal DNS resolution generates no packets directly to the target hosts, so it can enumerate live systems indirectly while blending into ordinary name-resolution traffic. Option D (Passive OS fingerprinting) is correct because it relies on sniffing existing traffic (e.g., with p0f or Wireshark) rather than sending probes, making it essentially undetectable since no packets are transmitted to the targets. Option A (Ping sweep) is not appropriate because ICMP echo requests sent to every address are noisy and easily detected or blocked by firewalls. Option B (ARP scan) is not appropriate here because ARP only works within the local broadcast domain and cannot scan a routed IP range. Option E (TCP SYN scan) is not appropriate because it actively sends SYN packets to many ports/hosts, which is highly detectable by IDS/IPS and logging.

Answer

Ping sweep

Answer

ARP scan

Answer

TCP SYN scan

Question 9

A security analyst wants to discover all DNS records associated with a domain without triggering a full zone transfer. Which tool is BEST suited for this task?

Accepted Answer

dnsrecon. D (dnsrecon) is correct because it is a dedicated DNS enumeration tool that performs multiple types of DNS record queries (A, AAAA, CNAME, MX, NS, SOA, SRV, TXT, etc.) using techniques like brute‑forcing subdomains and performing SRV record enumeration, all without attempting a full zone transfer (AXFR). It is specifically designed for reconnaissance and can discover hidden or non‑obvious DNS records efficiently.

Answer

theHarvester

Answer

dig

Answer

nslookup

Question 10

A security analyst wants to perform banner grabbing on a web server without establishing a full TCP connection. Which tool would be MOST appropriate?

Accepted Answer

Wireshark. Wireshark is the only tool listed that can perform banner grabbing without establishing a full TCP connection because it operates passively by capturing network traffic. It can capture banners transmitted during existing sessions. Telnet, Nmap with -sT, and Netcat all require completing the TCP handshake to receive the banner, thus they do not meet the condition of 'without establishing a full TCP connection.'

Answer

Telnet

Answer

Nmap with -sT

Answer

Netcat

Question 11

During a vulnerability assessment, which of the following tools is a comprehensive vulnerability scanner that uses a plugin architecture to detect thousands of vulnerabilities?

Accepted Answer

Nessus. Nessus is a comprehensive vulnerability scanner that uses a plugin-based architecture to detect thousands of vulnerabilities across a wide range of systems and services. Each plugin corresponds to a specific vulnerability check, and the Nessus engine executes them in sequence or in parallel against the target, making it highly extensible and up-to-date with the latest CVEs.

Answer

Wireshark

Answer

OpenVAS

Answer

Nmap

Question 12

Which THREE of the following are valid Nmap NSE scripts that could be used for service version detection or vulnerability scanning? (Choose THREE.)

Accepted Answer

ssl-heartbleed. Option C, ssl-heartbleed, is a valid Nmap NSE script that detects whether a service is vulnerable to the Heartbleed bug (CVE-2014-0160) in OpenSSL, making it a genuine vulnerability-scanning script. Option D, banner, is a valid NSE script that grabs service banners to help identify the software and version running on a port, which supports service version detection. Option E, http-sql-injection, is a valid NSE script that probes HTTP services for SQL injection vulnerabilities, so it qualifies as a vulnerability-scanning script. Option A, dns-zone-transfer, is not a real Nmap NSE script name (the actual script is dns-zone-transfer.nse only in some third-party collections; standard Nmap uses dns-zone-transfer via the dns-zone-transfer script name, but it is not among the standard NSE scripts for version detection or vulnerability scanning in the way the question frames it), and Option B, smb-os-discovery, is a valid NSE script but it is used for OS discovery, not service version detection or vulnerability scanning, so it does not fit the scenario.

Answer

dns-zone-transfer

Answer

smb-os-discovery

Question 13

An incident responder analyzes logs and finds repeated failed zone transfer attempts from an external IP. The zone transfer requests are targeting the domain example.com. Which DNS record type, if misconfigured, would allow this attack to succeed?

Accepted Answer

AXFR. B is correct because AXFR (Asynchronous Full Transfer) is the DNS zone transfer protocol that, if misconfigured (i.e., allowing unrestricted AXFR queries from any IP), permits an external attacker to request and receive the entire DNS zone file for example.com. The repeated failed attempts indicate the attacker is probing for an open AXFR service, which would succeed if the DNS server is configured to allow zone transfers to any host without restriction.

Answer

NS records

Answer

MX records

Answer

SOA records

Question 14

Which TWO of the following are examples of passive OS fingerprinting techniques? (Select 2)

Accepted Answer

Analyzing the initial TTL value of received IP packets. Option B is correct because analyzing the initial TTL value of received IP packets is a passive technique: the attacker only observes traffic already sent by the target, and default TTL values (e.g., 64 for Linux/macOS, 128 for Windows, 255 for some network devices) can hint at the target's OS without sending any probe. Option D is correct because inspecting the TCP window size in SYN packets is likewise passive — the window size advertised in a SYN/ACK or SYN packet (e.g., 5840, 65535, 8192) is a known OS fingerprinting artifact observed from existing traffic rather than elicited by crafted packets. Option A is incorrect because a SYN scan is an active technique that sends probe packets to the target to elicit responses. Option C is incorrect because sending TCP packets with varying flags and analyzing replies is active fingerprinting (e.g., nmap's OS detection), as it injects traffic. Option E is incorrect because using telnet to connect to port 80 is an active connection attempt that generates traffic toward the target, not passive observation.

Answer

Performing a SYN scan on the target

Answer

Sending a series of TCP packets with different flags and analyzing responses

Answer

Using the telnet command to connect to port 80

Question 15

Which THREE of the following are valid methods to prevent DNS zone transfer attacks? (Select 3)

Accepted Answer

Use TSIG (Transaction Signatures) for authentication. Option C (Use TSIG for authentication) is correct because TSIG uses a shared secret and HMAC to cryptographically sign zone-transfer requests and responses, so a slave server can only obtain the zone if it proves knowledge of the key, preventing unauthorized AXFR/IXFR transfers. Option D (Restrict zone transfers to specific IP addresses) is correct because configuring allow-transfer ACLs (e.g., in BIND) limits AXFR/IXFR to trusted secondary servers, blocking arbitrary external hosts from pulling the entire zone. The question asks for THREE correct answers, but only two options are marked [CORRECT]; among the unmarked options, A is wrong because the SOA refresh interval only controls how often a secondary checks the serial and does not restrict who can transfer the zone, B is wrong because disabling recursion mitigates cache-poisoning/amplification abuse rather than zone-transfer exposure, and E is wrong because blocking all inbound UDP/53 would break legitimate DNS resolution and does not specifically prevent TCP-based AXFR zone transfers.

Answer

Increase the SOA refresh interval

Answer

Disable recursive queries for external hosts

Answer

Block all inbound traffic on UDP port 53

Question 16

Which TWO of the following are examples of active reconnaissance? (Select 2)

Accepted Answer

Conducting an Nmap SYN scan on the target network. An Nmap SYN scan sends raw SYN packets to target ports and analyzes the responses (SYN-ACK for open, RST for closed). This actively probes the target network, generating traffic that can be detected by intrusion detection systems, which is the defining characteristic of active reconnaissance.

Answer

Performing a WHOIS lookup

Answer

Analyzing public social media profiles for employee information

Answer

Running a Google dork search for sensitive files

Question 17

A penetration tester is performing active reconnaissance against a web server and wants to identify the web server software, version, and enabled modules without triggering verbose error messages. The tester decides to use Nmap NSE scripts. Which TWO of the following NSE scripts are designed to gather HTTP server information? (Choose two.)

Accepted Answer

http-enum. The http-headers script retrieves HTTP response headers, often exposing the Server header with software and version details. The http-enum script enumerates common directories and files, which can reveal enabled modules and applications. Together, they provide the server software, version, and module information the tester seeks without causing verbose errors.

Answer

http-git

Answer

http-methods

Answer

http-title

Question 18

A security analyst runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?

Accepted Answer

Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting. The `-sS` flag initiates a TCP SYN stealth scan, `-sV` enables service version detection, and `-O` attempts OS fingerprinting. The `-p 22,80,443,3389` limits the scan to those four ports, and the target `192.168.1.0/24` scans the entire Class C subnet. This combination performs a half-open scan on the specified ports, probes for application versions, and tries to identify the operating system of each live host.

Answer

Perform a full TCP connect scan with UDP service detection on all ports

Answer

Perform an aggressive scan of all open ports and enumerate SMB shares

Answer

Perform a UDP scan on the four specified ports and identify running services

Question 19

During a passive reconnaissance phase, a penetration tester uses a tool to gather email addresses, subdomains, and employee names associated with a target domain without directly interacting with the target's systems. Which tool is BEST suited for this purpose?

Accepted Answer

theHarvester. theHarvester is specifically designed for passive reconnaissance by querying public sources such as search engines (Google, Bing), PGP key servers, and the Shodan API to collect email addresses, subdomains, and employee names without sending any packets directly to the target's infrastructure. This aligns perfectly with the requirement of gathering OSINT data without direct interaction.

Answer

Nmap

Answer

Netcat

Answer

Wireshark

Question 20

A security analyst notices unusual outbound traffic from an internal server to a known malicious IP address on port 4444. The server is running a web application that was recently scanned using a vulnerability scanner. Which of the following is the MOST likely cause?

Accepted Answer

A vulnerability discovered during the scan was exploited, establishing a reverse shell connection to the attacker. Outbound traffic on port 4444 from an internal server to a known malicious IP is a classic indicator of a reverse shell connection. A reverse shell is a common post-exploitation technique where an attacker forces the victim server to connect back to their listener, often on high ports like 4444, bypassing inbound firewall rules. The timing after a vulnerability scan strongly suggests that a discovered vulnerability (e.g., command injection, RCE) was exploited to establish this shell.

Answer

The server is performing a DNS lookup to resolve the malicious IP address

Answer

The web application is sending log data to a SIEM system for analysis

Answer

The vulnerability scan caused a false positive and triggered a legitimate backup process

CEH Footprinting, Reconnaissance and Scanning — All Questions With Answers

A penetration tester is attempting to evade an IDS/IPS while performing a port scan. They use the Nmap command: nmap -sS -f --data-length 20 -D RND:10 10.0.0.1. Which techniques are being employed to evade detection?

A security analyst observes that an Nmap SYN scan against a target network returns all ports as 'filtered'. The analyst suspects an IDS/IPS is dropping inbound SYN packets. Which Nmap technique would MOST likely bypass this detection while still identifying open ports?

A security analyst runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?

Which TWO of the following are passive reconnaissance techniques? (Select 2)

During a security assessment, a tester uses Netcat to connect to a target's SMTP port and receive the service banner. Which command would achieve this?

A penetration tester is conducting reconnaissance and wants to identify live hosts in a range without being detected. Which TWO techniques would be MOST appropriate? (Choose two.)

A security analyst wants to discover all DNS records associated with a domain without triggering a full zone transfer. Which tool is BEST suited for this task?

A security analyst wants to perform banner grabbing on a web server without establishing a full TCP connection. Which tool would be MOST appropriate?

During a vulnerability assessment, which of the following tools is a comprehensive vulnerability scanner that uses a plugin architecture to detect thousands of vulnerabilities?

Which THREE of the following are valid Nmap NSE scripts that could be used for service version detection or vulnerability scanning? (Choose THREE.)

An incident responder analyzes logs and finds repeated failed zone transfer attempts from an external IP. The zone transfer requests are targeting the domain example.com. Which DNS record type, if misconfigured, would allow this attack to succeed?

Which TWO of the following are examples of passive OS fingerprinting techniques? (Select 2)

Which THREE of the following are valid methods to prevent DNS zone transfer attacks? (Select 3)

Which TWO of the following are examples of active reconnaissance? (Select 2)

A security analyst runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?

During a passive reconnaissance phase, a penetration tester uses a tool to gather email addresses, subdomains, and employee names associated with a target domain without directly interacting with the target's systems. Which tool is BEST suited for this purpose?

A security analyst notices unusual outbound traffic from an internal server to a known malicious IP address on port 4444. The server is running a web application that was recently scanned using a vulnerability scanner. Which of the following is the MOST likely cause?

During a penetration test, you execute the following command: dnsrecon -d example.com -t axfr. The output shows 'AXFR record received' followed by a list of all DNS records. What does this indicate about the target's DNS configuration?

Which Google dork would a penetration tester use to find login pages of websites that have 'admin' in the URL?

A security team wants to identify all live hosts on a large, Class B private IP network (172.16.0.0/16) as quickly as possible while minimizing network load. Which tool and technique should they use?

A security analyst is conducting a vulnerability scan on a web server using Nessus. After the scan, they notice that the server's performance has degraded significantly, and some services have become unresponsive. Which of the following actions could have prevented this issue?

During a security assessment, a tester uses Maltego to gather information about a target organization. Which type of reconnaissance is being performed?

A security analyst receives an alert about a scan originating from an IP address that appears to be using a 'sIdle scan' technique. Which of the following characteristics would confirm this?

A junior penetration tester runs the command: whois example.com. What type of information are they MOST likely trying to obtain?

A security analyst is planning a reconnaissance activity that must remain undetected. Which TWO of the following techniques should they choose?

During a penetration test, you need to enumerate all DNS records for example.com using a zone transfer. Which TWO tools can be used to attempt this?

Which THREE of the following are valid Nmap port states?

A security analyst wants to perform passive reconnaissance on a target organization without generating any traffic to the target's network. Which of the following techniques would be MOST appropriate?

Which of the following tools is specifically designed to perform Google dorking and automate searching for vulnerable web applications and sensitive information?

During a penetration test, you need to identify all live hosts on a target network without being detected by intrusion detection systems. Which Nmap flag would BEST achieve this?

A penetration tester executes the following command: nmap -sS -p 1-1000 --script banner 192.168.1.10. After the scan, the tester notices several filtered ports. Which of the following BEST explains why Nmap reports a port as "filtered"?

A security analyst is performing reconnaissance on a target domain and wants to discover all subdomains using DNS enumeration. Which of the following commands would be MOST effective for performing a DNS zone transfer attempt?

During a penetration test, you run the following command: hping3 -S -p 80 --flood 192.168.1.100. What is the PRIMARY purpose of this command?

A penetration tester is conducting a vulnerability scan against a target network. Which of the following tools is BEST suited for this task?

An attacker uses a technique where they send a SYN packet with a spoofed source IP address to the target, and the target responds with SYN/ACK to the spoofed IP. The attacker never completes the handshake. This technique is known as:

A security analyst receives an alert from the IDS indicating a port scan originating from IP 10.0.0.5. Upon investigation, the analyst finds that 10.0.0.5 is a legitimate internal server. Which type of scan is the attacker likely using to evade detection?

Which of the following OSINT techniques would be MOST effective for discovering email addresses and employee names associated with a target organization?

A penetration tester is trying to evade an IDS that detects out-of-order TCP packets. The tester uses Nmap with the -f flag. What is the PRIMARY effect of this flag?

You are performing a penetration test and need to quickly scan a large IP range (e.g., 10.0.0.0/8) for open ports 80 and 443. Which tool is BEST suited for this high-speed scanning task?

Which TWO of the following are passive reconnaissance techniques? (Select 2)

Which TWO of the following Nmap flags can be used to bypass firewall restrictions? (Select 2)

Which THREE of the following are valid DNS record types that an attacker might query during reconnaissance to gather information about a target domain? (Select 3)

A security analyst runs `nmap -sS -sV -A 192.168.1.100` and obtains open ports and service versions. However, the analyst suspects the target is behind an IDS/IPS. Which Nmap technique would BEST evade detection while still performing a similar scan?

During a penetration test, you execute `theHarvester -d example.com -b google,linkedin`. What type of data is this tool primarily designed to collect?

An attacker uses `nmap -sI 10.0.0.5 192.168.1.10` to scan a target. This technique is known as an idle scan. Which condition is REQUIRED for this scan to work correctly?

Which of the following techniques is considered PASSIVE reconnaissance?

What is the PRIMARY purpose of performing a DNS zone transfer?

A penetration tester wants to identify live hosts on a large IP range without generating excessive network traffic. Which tool is BEST suited for fast host discovery?

Which Google dork would a penetration tester use to find login pages that are indexed by Google?

During a security assessment, a tester uses `nmap -sU 192.168.1.1`. What type of scan does this command perform?

A penetration tester is scanning a target and receives the output: 'PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https'. Which Nmap flag was MOST likely used to obtain this output?

An attacker sends a TCP SYN packet to a port and receives a TCP RST packet in response. According to Nmap's port state classification, what is the state of this port?

During a reconnaissance phase, a tester uses `dnsrecon -d example.com -t axfr`. What specific DNS query is being attempted?

A security analyst wants to perform passive reconnaissance on a target domain. Which TWO of the following methods are considered passive? (Choose 2)

Which THREE of the following are examples of OSINT techniques? (Choose 3)

A security analyst wants to gather information about a target domain without directly interacting with its systems. Which technique would be MOST appropriate?

During a penetration test, you run the following command: nmap -sV -p 80 --script http-title 192.168.1.10. The output shows that port 80 is open and the HTTP title is 'Login Portal'. Which phase of the penetration testing methodology does this activity represent?

A penetration tester is performing reconnaissance and wants to identify email addresses associated with a target domain. Which tool is specifically designed for this purpose?

During a security assessment, you execute: dnsenum --enum example.com. The tool returns results including the nameservers (NS), mail servers (MX), and performs a zone transfer attempt. The zone transfer fails. What is the MOST likely reason for the failure?

Which of the following best describes the difference between active and passive reconnaissance?

A security analyst runs the following command: hping3 -S -p 80 -c 1 192.168.1.1. The response received is an RST/ACK packet. What does this indicate about port 80 on the target?

Which Google dork query would an attacker most likely use to find login pages on a web server?

A penetration tester uses the following Nmap command: nmap -sS -O -p 1-1000 10.0.0.1. The output shows port 22 as open, and OS detection suggests 'Linux 2.6.x'. The tester then runs: nmap -sV -p 22 10.0.0.1. What additional information does the second scan provide?

What is the primary purpose of using the Nmap flag -sS?

A security analyst receives an alert that an external IP address is sending fragmented packets to the company's web server on port 80. The analyst suspects the attacker is using Nmap with fragmentation. Which Nmap flag is being used to fragment the probe packets?

Which of the following tools would be BEST to use for identifying all live hosts in a large IP range (e.g., 10.0.0.0/8) quickly?

Which TWO of the following are passive reconnaissance techniques?

Which THREE of the following are correct statements about DNS zone transfers?

Which TWO of the following Nmap scans are considered 'stealth' scans that do not complete a full TCP three-way handshake?

During a penetration test, a tester wants to gather email addresses, subdomains, and employee names associated with a target domain. Which of the following tools is specifically designed for such passive reconnaissance?

A security team detects unusual outbound traffic from a host that appears to be a reverse shell. Which of the following Nmap features would be MOST effective for identifying the service running on the listening port of the command-and-control server?

A penetration tester uses the following Google dork: site:example.com filetype:pdf inurl:confidential. What is the MOST likely goal of this search?

During a security assessment, a tester runs hping3 with the command: hping3 -S -p 80 -c 5 10.0.0.1. The response shows that packets with the SYN flag set receive SYN-ACK replies. Which of the following conclusions is MOST accurate?

A security analyst wants to identify all live hosts on a network without generating excessive traffic. Which of the following techniques is MOST appropriate for this purpose?

A security engineer is concerned about DNS zone transfer attacks. Which of the following countermeasures would be MOST effective in preventing unauthorized zone transfers?

A penetration tester receives the following output from a tool: 'Starting dnsrecon.py -d example.com -t axfr' and then a list of all DNS records. Which of the following BEST describes what occurred?

An analyst wants to perform a SYN flood attack test against a server to evaluate its resilience. Which of the following tools would be the MOST appropriate for this task?

During a penetration test, a tester uses Nmap with the command: nmap -sS -D RND:10 192.168.1.100. After the scan, the IDS logs show multiple SYN packets from different source IPs hitting the target. However, the tester's true IP is not among them. Which of the following techniques is being used?

Which of the following tools is specifically designed to search the internet for exposed devices and services, such as industrial control systems and webcams, using banners and metadata?