CEH Footprinting, Reconnaissance and Scanning Practice Test 3 — 15 Questions

Question 1

A security analyst runs `nmap -sS -sV -A 192.168.1.100` and obtains open ports and service versions. However, the analyst suspects the target is behind an IDS/IPS. Which Nmap technique would BEST evade detection while still performing a similar scan?

Accepted Answer

Add -f to fragment IP packets. Option A is correct because using the `-f` flag fragments the IP packets, splitting the TCP header across multiple packets. This helps evade simple IDS/IPS signatures that rely on detecting a complete SYN scan in a single packet, as the fragmented packets may bypass pattern-matching rules or reassembly buffers.

Answer

Use -sT instead of -sS to perform a full TCP connect scan

Answer

Increase timing to -T5 for a faster scan

Answer

Replace -sV with -sU to scan UDP services

Question 2

During a penetration test, you execute `theHarvester -d example.com -b google,linkedin`. What type of data is this tool primarily designed to collect?

Accepted Answer

Email addresses, subdomains, and employee names from public sources. TheHarvester is an open-source intelligence (OSINT) tool designed to gather publicly available information from search engines, PGP key servers, and social platforms. The command `-d example.com -b google,linkedin` instructs it to scrape Google and LinkedIn for email addresses, subdomains, and employee names associated with the target domain, which are classic footprinting data used in reconnaissance.

Answer

Password hashes and user credentials from compromised databases

Answer

DNS zone transfer information and TXT records

Answer

Vulnerability scan results from Nessus and OpenVAS

Question 3

An attacker uses `nmap -sI 10.0.0.5 192.168.1.10` to scan a target. This technique is known as an idle scan. Which condition is REQUIRED for this scan to work correctly?

Accepted Answer

The zombie host must have an incremental IP ID sequence that is not reset by other traffic. The idle scan (nmap -sI) relies on the zombie host's IP ID sequence being predictable and incremental. The attacker probes the zombie's IP ID, sends a spoofed SYN packet to the target (appearing from the zombie), and then re-checks the zombie's IP ID. If the IP ID has increased by exactly 2 (or more if other traffic occurred), the target responded to the zombie, confirming the port is open. The zombie must not reset or randomize its IP ID, and other traffic to the zombie must be minimal or accounted for, making an incremental IP ID sequence the essential condition.

Answer

The zombie host must be running a Windows operating system

Answer

The attacker must have root access on the target machine

Answer

The target must be running a Linux server with SSH enabled

Question 4

Which of the following techniques is considered PASSIVE reconnaissance?

Accepted Answer

Performing a WHOIS lookup. WHOIS queries retrieve domain registration records from public databases like whois.iana.org or RDAP servers. Since the target server is never contacted directly — only public registries are queried — no packets are sent to the target's infrastructure, making it a purely passive reconnaissance technique.

Answer

Ping sweeping a subnet

Answer

Banner grabbing with Telnet

Answer

Running a SYN scan with Nmap

Question 5

A security analyst observes unusual outbound traffic from an internal host to an external IP on port 443. The analyst suspects a reverse shell where the internal host initiates an HTTPS connection to the attacker. Which Nmap script would be MOST useful to confirm the nature of this traffic if the analyst can run a scan on the internal host?

Accepted Answer

http-malware-host. Option C (http-malware-host) is correct because it checks the internal host's DNS cache or HTTP traffic against known malware domains, which can reveal if the outbound HTTPS connection is to a command-and-control server. Since the traffic is on port 443 (HTTPS), this script can identify malicious destinations without decrypting the traffic, making it ideal for confirming a reverse shell scenario.

Answer

tls-nextprotoneg

Answer

smb-enum-shares

Answer

ssh2-enum-algos

Question 6

What is the PRIMARY purpose of performing a DNS zone transfer?

Accepted Answer

To obtain all DNS records for a domain from an authoritative server. DNS zone transfer (AXFR) is a mechanism defined in RFC 1034 and 1035 that allows a secondary DNS server to replicate the entire zone file from a primary authoritative server. The primary purpose is to obtain all DNS records for a domain, which is critical for reconnaissance during the footprinting phase, as it reveals subdomains, mail servers, and other infrastructure without brute-forcing.

Answer

To cache DNS queries locally

Answer

To resolve IP addresses to hostnames

Answer

To verify the DNS server's response time

Question 7

A penetration tester wants to identify live hosts on a large IP range without generating excessive network traffic. Which tool is BEST suited for fast host discovery?

Accepted Answer

Masscan. Masscan is the best tool for fast host discovery across large IP ranges because it uses asynchronous transmission and can scan the entire IPv4 address space in under 10 minutes at a rate of 10 million packets per second. It minimizes network traffic by sending only SYN packets and not completing the TCP handshake, making it ideal for rapid live host detection without overwhelming the network.

Answer

Maltego

Answer

dnsenum

Answer

Nessus

Question 8

Which Google dork would a penetration tester use to find login pages that are indexed by Google?

Accepted Answer

inurl:login. Option C is correct because the Google dork 'inurl:login' specifically searches for URLs containing the word 'login', which commonly appear in login page paths (e.g., /login.php, /login.aspx). This allows a penetration tester to quickly identify indexed login portals for further reconnaissance, such as testing for default credentials or brute-force attacks.

Answer

filetype:xls username password

Answer

intitle:"index of"

Answer

site:example.com intext:password

Question 9

During a security assessment, a tester uses `nmap -sU 192.168.1.1`. What type of scan does this command perform?

Accepted Answer

UDP scan. The `-sU` flag in Nmap explicitly instructs the tool to perform a UDP scan. This sends UDP packets to the target ports and analyzes responses (or lack thereof) to determine if a UDP port is open, closed, or filtered. Unlike TCP, UDP is connectionless, so the scan relies on ICMP unreachable messages or lack of response to infer port status.

Answer

TCP SYN scan

Answer

Ping sweep

Answer

OS fingerprinting

Question 10

A penetration tester is scanning a target and receives the output: 'PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https'. Which Nmap flag was MOST likely used to obtain this output?

Accepted Answer

-sS. The output shows open ports with their service names (ssh, http, https) but no version information. The -sS flag performs a SYN stealth scan, which by default probes common ports and uses the /etc/services file to map port numbers to service names. This matches the output format exactly, as -sS does not perform version detection or OS fingerprinting.

Answer

-O

Answer

-A

Answer

-sV

Question 11

An attacker sends a TCP SYN packet to a port and receives a TCP RST packet in response. According to Nmap's port state classification, what is the state of this port?

Accepted Answer

Closed. When Nmap sends a TCP SYN packet to a port and receives a TCP RST packet in response, it indicates that the port is reachable but no service is listening on it. Per RFC 793, a RST is sent when a SYN arrives on a closed port, so Nmap classifies this port as 'closed'.

Answer

Filtered

Answer

Unfiltered

Answer

Open

Question 12

During a reconnaissance phase, a tester uses `dnsrecon -d example.com -t axfr`. What specific DNS query is being attempted?

Accepted Answer

A zone transfer request. The `-t axfr` flag in `dnsrecon` specifies a zone transfer request (AXFR). This query attempts to retrieve the entire DNS zone file from a nameserver, which can reveal all DNS records for the domain. A successful zone transfer is a critical misconfiguration because it exposes internal network topology and hostnames.

Answer

A subdomain brute-force

Answer

A reverse DNS lookup

Answer

A SRV record enumeration

Question 13

A security analyst wants to perform passive reconnaissance on a target domain. Which TWO of the following methods are considered passive? (Choose 2)

Accepted Answer

WHOIS lookup. WHOIS lookup is passive because it queries public registration databases (e.g., ARIN, RIPE) via the WHOIS protocol (RFC 3912) to retrieve domain ownership, registrar, and name server information without sending any packets to the target's own infrastructure. This data is publicly available and does not interact with the target's servers or network, making it a classic passive reconnaissance technique.

Answer

Telnet banner grab

Answer

Ping sweep

Answer

Nmap SYN scan

Question 14

Which THREE of the following are examples of OSINT techniques? (Choose 3)

Accepted Answer

Shodan search. Shodan is a search engine for internet-connected devices, allowing users to discover open ports, services, and banners without directly interacting with the target. This is a classic OSINT technique because it gathers publicly available information from external sources, not from active scanning of the target's own infrastructure.

Answer

Nmap version detection

Answer

Nessus vulnerability scan

Question 15

A penetration tester runs `nmap -sS -sV -O -p- 192.168.1.10` and receives the following output snippet: 'PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4 80/tcp open http Apache httpd 2.4.6 443/tcp open ssl/http Apache httpd 2.4.6'. Which THREE pieces of information can the tester derive from this output? (Choose 3)

Accepted Answer

The -sV flag was used for version detection. Option B is correct because the `-sV` flag in Nmap explicitly enables version detection, which probes open ports to determine the service and version information displayed in the output (e.g., 'OpenSSH 7.4', 'Apache httpd 2.4.6'). Without `-sV`, Nmap would only report the service name based on its port mapping (e.g., 'ssh', 'http'), not the specific version numbers.

Answer

The target has a vulnerability in OpenSSH 7.4

Answer

The target is vulnerable to the Heartbleed bug