CEH Footprinting, Reconnaissance and Scanning Practice Test 2 — 15 Questions

Question 1

A security analyst wants to perform passive reconnaissance on a target organization without generating any traffic to the target's network. Which of the following techniques would be MOST appropriate?

Accepted Answer

Performing a WHOIS lookup. WHOIS lookup is a passive reconnaissance technique that queries public databases (e.g., whois.arin.net) for domain registration details without sending any packets to the target's network. It relies on external, publicly available data, thus generating zero traffic to the target organization's infrastructure.

Answer

Running Nmap SYN scan

Answer

Executing hping3 to probe ports

Answer

Using Netcat to connect to a service

Question 2

Which of the following tools is specifically designed to perform Google dorking and automate searching for vulnerable web applications and sensitive information?

Accepted Answer

Googledork. Googledork (also known as Google Dork) is a tool specifically designed to automate Google dorking queries, which use advanced search operators to find vulnerable web applications and sensitive information exposed in search results. It systematically executes predefined dork queries against Google's index to identify SQL injection points, exposed configuration files, login pages, and other security weaknesses, making it the correct choice for this task.

Answer

Maltego

Answer

theHarvester

Answer

Shodan

Question 3

During a penetration test, you need to identify all live hosts on a target network without being detected by intrusion detection systems. Which Nmap flag would BEST achieve this?

Accepted Answer

-sn (ping sweep). The -sn flag (ping sweep) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default to determine if a host is alive. This is the best choice for stealthy host discovery because it does not complete a full TCP handshake or send application-layer probes, minimizing the chance of triggering IDS signatures that look for port scans or OS fingerprinting.

Answer

-O (OS fingerprinting)

Answer

-sS (SYN scan)

Answer

-sV (version detection)

Question 4

A penetration tester executes the following command: nmap -sS -p 1-1000 --script banner 192.168.1.10. After the scan, the tester notices several filtered ports. Which of the following BEST explains why Nmap reports a port as "filtered"?

Accepted Answer

A firewall is blocking the probe packets, and Nmap cannot determine if the port is open. Option B is correct because Nmap's SYN scan (-sS) sends a SYN packet to the target port. When the probe receives no response or an ICMP unreachable message (e.g., type 3 code 13), Nmap classifies the port as 'filtered'. This typically indicates a firewall, ACL, or network filter is dropping the packets, preventing Nmap from determining whether the port is open or closed.

Answer

The port is open, and the service is responding with a banner

Answer

The port is open and actively listening

Answer

The port is closed and the target sent an RST packet

Question 5

A security analyst is performing reconnaissance on a target domain and wants to discover all subdomains using DNS enumeration. Which of the following commands would be MOST effective for performing a DNS zone transfer attempt?

Accepted Answer

dnsrecon -d example.com -t axfr. Option D is correct because the `-t axfr` flag in `dnsrecon` specifically attempts a DNS zone transfer (AXFR query) against the target domain's authoritative nameservers. A successful zone transfer returns all DNS records, including all subdomains, making it the most direct and effective method for subdomain enumeration via DNS zone transfer.

Answer

dig example.com ANY

Answer

nslookup -type=ns example.com

Answer

theHarvester -d example.com -l 500 -b google

Question 6

During a penetration test, you run the following command: hping3 -S -p 80 --flood 192.168.1.100. What is the PRIMARY purpose of this command?

Accepted Answer

Execute a denial-of-service (DoS) attack against the target's web server. The command `hping3 -S -p 80 --flood 192.168.1.100` sends a high volume of TCP SYN packets to port 80 of the target without completing the three-way handshake. The `--flood` flag disables packet rate limiting, causing a rapid stream of SYN packets that exhausts the target's connection queue, effectively performing a SYN flood denial-of-service (DoS) attack against the web server.

Answer

Banner grab the HTTP service on port 80

Answer

Fingerprint the operating system of the target

Answer

Perform a TCP connect scan to identify open ports

Question 7

A penetration tester is conducting a vulnerability scan against a target network. Which of the following tools is BEST suited for this task?

Accepted Answer

Nessus. Nessus is a dedicated vulnerability scanner that automates the process of identifying known vulnerabilities, misconfigurations, and missing patches across a target network. It uses a large plugin database (e.g., NASL scripts) to perform non-intrusive checks against services and operating systems, making it the best tool for a vulnerability scan. Unlike general-purpose tools, Nessus is specifically designed to correlate scan results with CVE entries and provide risk ratings, which is the core requirement of a vulnerability assessment.

Answer

Nmap

Answer

Wireshark

Answer

Metasploit

Question 8

An attacker uses a technique where they send a SYN packet with a spoofed source IP address to the target, and the target responds with SYN/ACK to the spoofed IP. The attacker never completes the handshake. This technique is known as:

Accepted Answer

Idle scan. The idle scan (option C) is correct because it uses a spoofed SYN packet with a zombie host's IP address to probe open ports on the target. The target sends a SYN/ACK to the zombie, but the attacker never completes the handshake; instead, the attacker monitors the zombie's IPID (IP Identification) field to infer whether the target's port is open or closed. This technique is defined in RFC 793 and leverages the zombie's predictable IPID sequence to perform a blind, stealthy scan.

Answer

SYN flood

Answer

TCP connect scan

Answer

Half-open scan

Question 9

A security analyst receives an alert from the IDS indicating a port scan originating from IP 10.0.0.5. Upon investigation, the analyst finds that 10.0.0.5 is a legitimate internal server. Which type of scan is the attacker likely using to evade detection?

Accepted Answer

Decoy scan. A decoy scan (option C) is the correct answer because it allows the attacker to blend their real IP address with multiple spoofed IP addresses, making it appear as though the scan originates from several hosts. In this scenario, the IDS alerts on IP 10.0.0.5, which is a legitimate internal server, indicating that the attacker is using that server's IP as a decoy to evade detection and misdirect the analyst's investigation.

Answer

SYN scan

Answer

Idle scan

Answer

Fragmentation scan

Question 10

Which of the following OSINT techniques would be MOST effective for discovering email addresses and employee names associated with a target organization?

Accepted Answer

theHarvester. theHarvester is specifically designed to gather emails, subdomains, IPs, and employee names from public sources like search engines, PGP key servers, and social networks.

Answer

Nmap scan

Answer

WHOIS lookup

Answer

Shodan search

Question 11

A penetration tester is trying to evade an IDS that detects out-of-order TCP packets. The tester uses Nmap with the -f flag. What is the PRIMARY effect of this flag?

Accepted Answer

Splits the TCP header into multiple packets to bypass simple packet filters. The `-f` flag in Nmap fragments the IP packet into smaller pieces, typically 8-byte fragments, which splits the TCP header across multiple packets. This fragmentation causes the IDS to see out-of-order or incomplete TCP headers, making it harder for signature-based detection to reassemble and match malicious patterns, thus bypassing simple packet filters that do not perform full TCP reassembly.

Answer

Slows down the scan to avoid triggering rate-based alarms

Answer

Sends packets from multiple decoy IP addresses to obscure the source

Answer

Spoofs the source IP address to hide the attacker's identity

Question 12

You are performing a penetration test and need to quickly scan a large IP range (e.g., 10.0.0.0/8) for open ports 80 and 443. Which tool is BEST suited for this high-speed scanning task?

Accepted Answer

Masscan. Masscan is the best tool for this task because it is designed specifically for high-speed port scanning, capable of transmitting packets at rates exceeding 10 million packets per second, which is necessary to scan a /8 subnet (over 16 million IPs) for ports 80 and 443 in a reasonable timeframe. Unlike Nmap, which optimizes for accuracy and service detection, Masscan uses asynchronous raw socket transmission and can be tuned with the --rate parameter to maximize throughput, making it ideal for large-scale reconnaissance.

Answer

OpenVAS

Answer

hping3

Answer

Nmap

Question 13

Which TWO of the following are passive reconnaissance techniques? (Select 2)

Accepted Answer

Performing a WHOIS lookup. A WHOIS lookup queries public databases (e.g., ARIN, RIPE) to retrieve domain registration details such as registrar, creation date, and name server records. This is passive because it relies on publicly available information without sending any packets to the target network or interacting with its live systems.

Answer

Running an Nmap version scan

Answer

Performing a ping sweep

Answer

Banner grabbing with Netcat

Question 14

Which TWO of the following Nmap flags can be used to bypass firewall restrictions? (Select 2)

Accepted Answer

-f (fragment packets). Option B is correct because the -f flag fragments packets into smaller 8-byte chunks, which can evade simple firewall rules that inspect packet headers for known signatures or block oversized packets. Option E is correct because the -D flag performs a decoy scan by spoofing multiple source IP addresses, making it difficult for a firewall to identify the true scanning host and block it.

Answer

-P0 (disable ping)

Answer

-T4 (aggressive timing)

Answer

-sS (SYN scan)

Question 15

Which THREE of the following are valid DNS record types that an attacker might query during reconnaissance to gather information about a target domain? (Select 3)

Accepted Answer

A (IPv4 address). The A record maps a domain name to an IPv4 address, which is fundamental for locating a target server. During reconnaissance, querying A records reveals the IP address of the target domain, enabling further scanning and attack planning. This is a standard DNS query type defined in RFC 1035.

Answer

FTP (file transfer)

Answer

HTTP (hypertext transfer)