CEH Footprinting, Reconnaissance and Scanning Practice Test 3 — 15 Questions

Question 1

Which of the following tools is specifically designed to perform Google dorking and automate searching for vulnerable web applications and sensitive information?

Accepted Answer

Googledork. Googledork (also known as Google Dork) is a tool specifically designed to automate Google dorking queries, which use advanced search operators to find vulnerable web applications and sensitive information exposed in search results. It systematically executes predefined dork queries against Google's index to identify SQL injection points, exposed configuration files, login pages, and other security weaknesses, making it the correct choice for this task.

Answer

Maltego

Answer

theHarvester

Answer

Shodan

Question 2

During a penetration test, you need to identify all live hosts on a target network without being detected by intrusion detection systems. Which Nmap flag would BEST achieve this?

Accepted Answer

-sn (ping sweep). The -sn flag (ping sweep) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default to determine if a host is alive. This is the best choice for stealthy host discovery because it does not complete a full TCP handshake or send application-layer probes, minimizing the chance of triggering IDS signatures that look for port scans or OS fingerprinting.

Answer

-O (OS fingerprinting)

Answer

-sS (SYN scan)

Answer

-sV (version detection)

Question 3

A penetration tester executes the following command: nmap -sS -p 1-1000 --script banner 192.168.1.10. After the scan, the tester notices several filtered ports. Which of the following BEST explains why Nmap reports a port as "filtered"?

Accepted Answer

A firewall is blocking the probe packets, and Nmap cannot determine if the port is open. Nmap's SYN scan (-sS) sends a SYN packet to the target port. When the probe receives no response or an ICMP unreachable message (e.g., type 3 code 13), Nmap classifies the port as 'filtered'. This typically indicates a firewall, ACL, or network filter is dropping the packets, preventing Nmap from determining whether the port is open or closed.

Answer

The port is open, and the service is responding with a banner

Answer

The port is open and actively listening

Answer

The port is closed and the target sent an RST packet

Question 4

A security analyst is performing reconnaissance on a target domain and wants to discover all subdomains using DNS enumeration. Which of the following commands would be MOST effective for performing a DNS zone transfer attempt?

Accepted Answer

dnsrecon -d example.com -t axfr. The `-t axfr` flag in `dnsrecon` specifically attempts a DNS zone transfer (AXFR query) against the target domain's authoritative nameservers. A successful zone transfer returns all DNS records, including all subdomains, making it the most direct and effective method for subdomain enumeration via DNS zone transfer.

Answer

dig example.com ANY

Answer

nslookup -type=ns example.com

Answer

theHarvester -d example.com -l 500 -b google

Question 5

During a penetration test, you run the following command: hping3 -S -p 80 --flood 192.168.1.100. What is the PRIMARY purpose of this command?

Accepted Answer

Execute a denial-of-service (DoS) attack against the target's web server. The command `hping3 -S -p 80 --flood 192.168.1.100` sends a high volume of TCP SYN packets to port 80 of the target without completing the three-way handshake. The `--flood` flag disables packet rate limiting, causing a rapid stream of SYN packets that exhausts the target's connection queue, effectively performing a SYN flood denial-of-service (DoS) attack against the web server.

Answer

Banner grab the HTTP service on port 80

Answer

Fingerprint the operating system of the target

Answer

Perform a TCP connect scan to identify open ports

Question 6

A penetration tester is conducting a vulnerability scan against a target network. Which of the following tools is BEST suited for this task?

Accepted Answer

Nessus. Nessus is a dedicated vulnerability scanner that automates the process of identifying known vulnerabilities, misconfigurations, and missing patches across a target network. It uses a large plugin database (e.g., NASL scripts) to perform non-intrusive checks against services and operating systems, making it the best tool for a vulnerability scan. Unlike general-purpose tools, Nessus is specifically designed to correlate scan results with CVE entries and provide risk ratings, which is the core requirement of a vulnerability assessment.

Answer

Nmap

Answer

Wireshark

Answer

Metasploit

Question 7

An attacker uses a technique where they send a SYN packet with a spoofed source IP address to the target, and the target responds with SYN/ACK to the spoofed IP. The attacker never completes the handshake. This technique is known as:

Accepted Answer

Idle scan. The idle scan (option C) is correct because it uses a spoofed SYN packet with a zombie host's IP address to probe open ports on the target. The target sends a SYN/ACK to the zombie, but the attacker never completes the handshake; instead, the attacker monitors the zombie's IPID (IP Identification) field to infer whether the target's port is open or closed. This technique is defined in RFC 793 and leverages the zombie's predictable IPID sequence to perform a blind, stealthy scan.

Answer

SYN flood

Answer

TCP connect scan

Answer

Half-open scan

Question 8

A security analyst receives an alert from the IDS indicating a port scan originating from IP 10.0.0.5. Upon investigation, the analyst finds that 10.0.0.5 is a legitimate internal server. Which type of scan is the attacker likely using to evade detection?

Accepted Answer

Decoy scan. A decoy scan (option C) is the correct answer because it allows the attacker to blend their real IP address with multiple spoofed IP addresses, making it appear as though the scan originates from several hosts. In this scenario, the IDS alerts on IP 10.0.0.5, which is a legitimate internal server, indicating that the attacker is using that server's IP as a decoy to evade detection and misdirect the analyst's investigation.

Answer

SYN scan

Answer

Idle scan

Answer

Fragmentation scan

Question 9

Which of the following OSINT techniques would be MOST effective for discovering email addresses and employee names associated with a target organization?

Accepted Answer

theHarvester. theHarvester is specifically designed to gather emails, subdomains, IPs, and employee names from public sources like search engines, PGP key servers, and social networks.

Answer

Nmap scan

Answer

WHOIS lookup

Answer

Shodan search

Question 10

A penetration tester is trying to evade an IDS that detects out-of-order TCP packets. The tester uses Nmap with the -f flag. What is the PRIMARY effect of this flag?

Accepted Answer

Splits the TCP header into multiple packets to bypass simple packet filters. The `-f` flag in Nmap fragments the IP packet into smaller pieces, typically 8-byte fragments, which splits the TCP header across multiple packets. This fragmentation causes the IDS to see out-of-order or incomplete TCP headers, making it harder for signature-based detection to reassemble and match malicious patterns, thus bypassing simple packet filters that do not perform full TCP reassembly.

Answer

Slows down the scan to avoid triggering rate-based alarms

Answer

Sends packets from multiple decoy IP addresses to obscure the source

Answer

Spoofs the source IP address to hide the attacker's identity

Question 11

You are performing a penetration test and need to quickly scan a large IP range (e.g., 10.0.0.0/8) for open ports 80 and 443. Which tool is BEST suited for this high-speed scanning task?

Accepted Answer

Masscan. Masscan is the best tool for this task because it is designed specifically for high-speed port scanning, capable of transmitting packets at rates exceeding 10 million packets per second, which is necessary to scan a /8 subnet (over 16 million IPs) for ports 80 and 443 in a reasonable timeframe. Unlike Nmap, which optimizes for accuracy and service detection, Masscan uses asynchronous raw socket transmission and can be tuned with the --rate parameter to maximize throughput, making it ideal for large-scale reconnaissance.

Answer

OpenVAS

Answer

hping3

Answer

Nmap

Question 12

Which TWO of the following are passive reconnaissance techniques? (Select 2)

Accepted Answer

Performing a WHOIS lookup. A WHOIS lookup queries public databases (e.g., ARIN, RIPE) to retrieve domain registration details such as registrar, creation date, and name server records. This is passive because it relies on publicly available information without sending any packets to the target network or interacting with its live systems.

Answer

Running an Nmap version scan

Answer

Performing a ping sweep

Answer

Banner grabbing with Netcat

Question 13

Which TWO of the following Nmap flags can be used to bypass firewall restrictions? (Select 2)

Accepted Answer

-f (fragment packets). The -f flag fragments packets into smaller 8-byte chunks, which can evade simple firewall rules that inspect packet headers for known signatures or block oversized packets. Option E is correct because the -D flag performs a decoy scan by spoofing multiple source IP addresses, making it difficult for a firewall to identify the true scanning host and block it.

Answer

-P0 (disable ping)

Answer

-T4 (aggressive timing)

Answer

-sS (SYN scan)

Question 14

A security analyst runs `nmap -sS -sV -A 192.168.1.100` and obtains open ports and service versions. However, the analyst suspects the target is behind an IDS/IPS. Which Nmap technique would BEST evade detection while still performing a similar scan?

Accepted Answer

Add -f to fragment IP packets. Using the `-f` flag fragments the IP packets, splitting the TCP header across multiple packets. This helps evade simple IDS/IPS signatures that rely on detecting a complete SYN scan in a single packet, as the fragmented packets may bypass pattern-matching rules or reassembly buffers.

Answer

Use -sT instead of -sS to perform a full TCP connect scan

Answer

Increase timing to -T5 for a faster scan

Answer

Replace -sV with -sU to scan UDP services

Question 15

During a penetration test, you execute `theHarvester -d example.com -b google,linkedin`. What type of data is this tool primarily designed to collect?

Accepted Answer

Email addresses, subdomains, and employee names from public sources. TheHarvester is an open-source intelligence (OSINT) tool designed to gather publicly available information from search engines, PGP key servers, and social platforms. The command `-d example.com -b google,linkedin` instructs it to scrape Google and LinkedIn for email addresses, subdomains, and employee names associated with the target domain, which are classic footprinting data used in reconnaissance.

Answer

Password hashes and user credentials from compromised databases

Answer

DNS zone transfer information and TXT records

Answer

Vulnerability scan results from Nessus and OpenVAS