CEH Footprinting, Reconnaissance and Scanning Practice Test 10 — 15 Questions

Question 1

During a vulnerability scan with Nessus, you find that port 445/TCP is open on a Windows server. Which of the following is the MOST likely associated risk?

Accepted Answer

Remote code execution via SMB vulnerabilities. Port 445/TCP is used by Microsoft SMB (Server Message Block) over a direct TCP connection, commonly known as SMB over TCP. SMB has historically been plagued by critical remote code execution vulnerabilities, most notably EternalBlue (MS17-010) exploited by WannaCry. Therefore, an open SMB port on a Windows server presents a high risk of remote code execution if unpatched.

Answer

SNMP community string brute-forcing

Answer

HTTP directory traversal

Answer

DNS cache poisoning

Question 2

A security analyst issues the command `dnsenum example.com` and receives a list of subdomains, mail servers, and name servers. What information is revealed by the presence of multiple MX records?

Accepted Answer

The domain uses multiple mail servers for load balancing and failover. Multiple MX records in a DNS zone file indicate that the domain is configured with more than one mail exchange server. This setup provides redundancy and load balancing for email delivery, as defined in RFC 5321. The `dnsenum` tool enumerates these records from the DNS server, revealing the domain's email infrastructure design.

Answer

The domain has been compromised

Answer

The domain uses a single mail server with multiple aliases

Answer

The domain is participating in a DDoS attack

Question 3

Which TWO of the following are considered passive reconnaissance techniques? (Choose TWO.)

Accepted Answer

WHOIS lookup. WHOIS lookup is a passive reconnaissance technique because it queries public domain registration databases (via WHOIS protocol, RFC 3912) to obtain information such as registrar, registrant contact details, name servers, and expiration dates. This process does not send any packets directly to the target's infrastructure; instead, it relies on third-party data sources, making it undetectable by the target.

Answer

Ping sweep

Answer

Banner grabbing with Telnet

Answer

Port scanning

Question 4

You need to perform a fast scan of all 65535 TCP ports on a target IP address. Which tool is specifically designed for high-speed scanning and can surpass Nmap's speed on large-scale networks?

Accepted Answer

Masscan. Masscan is the correct answer because it is specifically engineered for high-speed asynchronous scanning, capable of transmitting packets at rates exceeding 10 million packets per second, which allows it to scan all 65535 TCP ports on a target significantly faster than Nmap, even with the -T5 timing template. Unlike Nmap's synchronous or adaptive scanning, Masscan uses a custom TCP/IP stack and raw sockets to maximize throughput, making it the optimal tool for large-scale network reconnaissance.

Answer

Netcat

Answer

hping3

Answer

Nmap with -T5

Question 5

A penetration tester runs `nmap -sI 192.168.1.10 -p 80 10.0.0.1` and receives output indicating port 80 is open. The scan uses a zombie host. Which type of scan is this?

Accepted Answer

Idle scan. The `-sI` flag in Nmap specifies an idle scan, which uses a zombie host (192.168.1.10) to probe the target (10.0.0.1). By observing changes in the zombie's IP ID sequence, the attacker can infer whether a port on the target is open or closed without revealing their own IP address. The output indicating port 80 is open confirms the scan type as an idle scan.

Answer

SYN scan

Answer

Decoy scan

Answer

Fragmentation scan

Question 6

A security analyst wants to gather information about a target domain without sending any packets to the target. Which technique should the analyst use?

Accepted Answer

WHOIS lookup. WHOIS lookup is a passive reconnaissance technique that queries public databases (e.g., RDAP or WHOIS servers) for domain registration details such as registrar, creation date, and administrative contacts. It requires no packets to be sent to the target domain's infrastructure, making it ideal for information gathering without direct interaction.

Answer

Ping sweep

Answer

Netcat banner grab

Answer

Nmap SYN scan

Question 7

During a penetration test, the tester uses a tool that queries search engines with specific operators to find sensitive information such as login pages, exposed directories, and file types. Which tool or technique is being used?

Accepted Answer

Google dorking. Google dorking (also known as Google hacking) uses advanced search operators (e.g., intitle:, filetype:, inurl:) to uncover sensitive information indexed by search engines, such as login pages, exposed directories, and specific file types. This technique directly matches the description of querying search engines with operators to find hidden or sensitive data.

Answer

Shodan

Answer

theHarvester

Answer

DNS zone transfer

Question 8

A penetration tester observes that an Nmap SYN scan shows all 1000 TCP ports as open. The tester suspects the target is using a security appliance that responds with SYN-ACK to all connection attempts, regardless of the actual port state. Which type of Nmap scan would be MOST effective in determining the true state of the ports?

Accepted Answer

TCP connect scan (-sT). A TCP connect scan (-sT) completes the full three-way handshake, which forces the target to respond with a RST if the port is actually closed, even if a security appliance initially sends SYN-ACK to all ports. This distinguishes between ports that are truly open (where the handshake completes) and those that are falsely reported as open by the appliance (where the handshake fails or a RST is received).

Answer

UDP scan (-sU)

Answer

Ping sweep (-sn)

Answer

Idle scan (-sI)

Question 9

An incident responder analyzes logs and finds repeated failed zone transfer attempts from an external IP. The zone transfer requests are targeting the domain example.com. Which DNS record type, if misconfigured, would allow this attack to succeed?

Accepted Answer

AXFR. B is correct because AXFR (Asynchronous Full Transfer) is the DNS zone transfer protocol that, if misconfigured (i.e., allowing unrestricted AXFR queries from any IP), permits an external attacker to request and receive the entire DNS zone file for example.com. The repeated failed attempts indicate the attacker is probing for an open AXFR service, which would succeed if the DNS server is configured to allow zone transfers to any host without restriction.

Answer

NS records

Answer

MX records

Answer

SOA records

Question 10

Which of the following tools is specifically designed to perform fast internet-wide scanning, often used in the reconnaissance phase to discover open ports across large IP ranges?

Accepted Answer

Masscan. Masscan is specifically designed for high-speed, asynchronous scanning of large IP ranges, capable of transmitting packets at rates exceeding 10 million packets per second. This makes it the optimal tool for internet-wide reconnaissance to discover open ports across vast address spaces, a task for which Nmap is too slow and hping3 is too manual.

Answer

hping3

Answer

OpenVAS

Answer

Nmap

Question 11

A penetration tester runs the following Nmap command: nmap -sU -sS -p 53,161,162,500 10.0.0.1 and receives no responses for UDP scans but standard results for TCP. The tester suspects the target is dropping all UDP packets. Which Nmap option could help increase the likelihood of UDP responses by fragmenting the probe?

Accepted Answer

-f. The -f option fragments the probe packets into smaller IP fragments. When a target drops unfragmented UDP packets, fragmenting the probes can sometimes bypass simple packet filters or IDS/IPS that drop larger or complete UDP datagrams, increasing the chance that the target will process and respond to the fragments.

Answer

-T4

Answer

--reason

Answer

-Pn

Question 12

Which of the following is the PRIMARY purpose of banner grabbing during the reconnaissance phase?

Accepted Answer

To determine the version of a running service. Banner grabbing is a technique used to extract service banners that often include software name and version details. The primary purpose is to determine the version of a running service, as this information allows an attacker to identify known vulnerabilities specific to that version for further exploitation.

Answer

To discover open ports

Answer

To identify the operating system

Answer

To map the network topology

Question 13

During a vulnerability assessment, a security analyst receives an alert from the IDS that a scan with fragmented packets and spoofed source IPs is targeting the internal network. Which Nmap command MOST likely caused this alert?

Accepted Answer

nmap -f -D 10.0.0.1,10.0.0.2 192.168.1.1. The `-f` flag fragments the packets into smaller IP fragments, and the `-D` flag performs a decoy scan by spoofing source IPs. This combination causes the IDS to detect fragmented packets with spoofed source addresses, matching the alert description.

Answer

nmap -sS -O 192.168.1.1

Answer

nmap -sV -p 80 192.168.1.1

Answer

nmap -sU 192.168.1.1

Question 14

Which of the following Nmap scan types is MOST effective for evading a stateful firewall that only allows established connections? (Select one)

Accepted Answer

Idle scan (-sI). An idle scan (-sI) is effective against a stateful firewall that only allows established connections because it spoofs the source IP of a zombie host that already has an established session with the target. The firewall sees the packets as belonging to that existing session and allows them. A TCP SYN scan (-sS) sends unsolicited SYN packets that are not part of any existing session, so the stateful firewall would block them because it only permits traffic for established connections.

Answer

TCP SYN scan (-sS)

Answer

TCP connect scan (-sT)

Answer

Ping sweep (-sn)

Answer

UDP scan (-sU)

Question 15

Which TWO of the following describe the state of a port when Nmap reports it as 'filtered'? (Select 2)

Accepted Answer

A firewall is dropping the probe packets. Nmap reports a port as 'filtered' when it cannot determine whether the port is open or closed because probe packets are being dropped or blocked. Option C is correct because a firewall dropping probe packets (e.g., via a DROP rule in iptables or an ACL) prevents Nmap from receiving any response, leading to a 'filtered' state. Option D is correct because a firewall responding with ICMP unreachable errors (e.g., ICMP Type 3 Code 13, 'Communication Administratively Prohibited') also causes Nmap to classify the port as 'filtered', as the response indicates a filtering device is interfering.

Answer

The port is closed and the target sends a RST packet

Answer

The port is open and a service is listening

Answer

The port is open but no service is responding