CEH Footprinting, Reconnaissance and Scanning Practice Test 4 — 15 Questions

Question 1

Which THREE of the following are valid DNS record types that an attacker might query during reconnaissance to gather information about a target domain? (Select 3)

Accepted Answer

A (IPv4 address). Option B (A record) is correct because an A record maps a hostname to its IPv4 address, so querying it during reconnaissance reveals the IP addresses of the target's web, mail, or other hosts for further scanning. Option C (NS record) is correct because NS records identify the authoritative name servers for the domain, letting an attacker map the DNS infrastructure and potentially attempt zone transfers or subdomain enumeration. Option E (MX record) is correct because MX records list the mail exchange servers handling email for the domain, exposing mail infrastructure, third-party providers, and additional hostnames to investigate. Options A (FTP) and D (HTTP) are not DNS record types at all; they are application-layer protocols, and no DNS query returns an 'FTP' or 'HTTP' record, so they do not belong among valid DNS reconnaissance record types.

Answer

FTP (file transfer)

Answer

HTTP (hypertext transfer)

Question 2

A security analyst runs `nmap -sS -sV -A 192.168.1.100` and obtains open ports and service versions. However, the analyst suspects the target is behind an IDS/IPS. Which Nmap technique would BEST evade detection while still performing a similar scan?

Accepted Answer

Add -f to fragment IP packets. Using the `-f` flag fragments the IP packets, splitting the TCP header across multiple packets. This helps evade simple IDS/IPS signatures that rely on detecting a complete SYN scan in a single packet, as the fragmented packets may bypass pattern-matching rules or reassembly buffers.

Answer

Use -sT instead of -sS to perform a full TCP connect scan

Answer

Increase timing to -T5 for a faster scan

Answer

Replace -sV with -sU to scan UDP services

Question 3

During a penetration test, you execute `theHarvester -d example.com -b google,linkedin`. What type of data is this tool primarily designed to collect?

Accepted Answer

Email addresses, subdomains, and employee names from public sources. TheHarvester is an open-source intelligence (OSINT) tool designed to gather publicly available information from search engines, PGP key servers, and social platforms. The command `-d example.com -b google,linkedin` instructs it to scrape Google and LinkedIn for email addresses, subdomains, and employee names associated with the target domain, which are classic footprinting data used in reconnaissance.

Answer

Password hashes and user credentials from compromised databases

Answer

DNS zone transfer information and TXT records

Answer

Vulnerability scan results from Nessus and OpenVAS

Question 4

An attacker uses `nmap -sI 10.0.0.5 192.168.1.10` to scan a target. This technique is known as an idle scan. Which condition is REQUIRED for this scan to work correctly?

Accepted Answer

The zombie host must have an incremental IP ID sequence that is not reset by other traffic. The idle scan (nmap -sI) relies on the zombie host's IP ID sequence being predictable and incremental. The attacker probes the zombie's IP ID, sends a spoofed SYN packet to the target (appearing from the zombie), and then re-checks the zombie's IP ID. If the IP ID has increased by exactly 2 (or more if other traffic occurred), the target responded to the zombie, confirming the port is open. The zombie must not reset or randomize its IP ID, and other traffic to the zombie must be minimal or accounted for, making an incremental IP ID sequence the essential condition.

Answer

The zombie host must be running a Windows operating system

Answer

The attacker must have root access on the target machine

Answer

The target must be running a Linux server with SSH enabled

Question 5

Which of the following techniques is considered PASSIVE reconnaissance?

Accepted Answer

Performing a WHOIS lookup. WHOIS queries retrieve domain registration records from public databases like whois.iana.org or RDAP servers. Since the target server is never contacted directly — only public registries are queried — no packets are sent to the target's infrastructure, making it a purely passive reconnaissance technique.

Answer

Ping sweeping a subnet

Answer

Banner grabbing with Telnet

Answer

Running a SYN scan with Nmap

Question 6

What is the PRIMARY purpose of performing a DNS zone transfer?

Accepted Answer

To obtain all DNS records for a domain from an authoritative server. DNS zone transfer (AXFR) is a mechanism defined in RFC 1034 and 1035 that allows a secondary DNS server to replicate the entire zone file from a primary authoritative server. The primary purpose is to obtain all DNS records for a domain, which is critical for reconnaissance during the footprinting phase, as it reveals subdomains, mail servers, and other infrastructure without brute-forcing.

Answer

To cache DNS queries locally

Answer

To resolve IP addresses to hostnames

Answer

To verify the DNS server's response time

Question 7

A penetration tester wants to identify live hosts on a large IP range without generating excessive network traffic. Which tool is BEST suited for fast host discovery?

Accepted Answer

Masscan. Masscan is the best tool for fast host discovery across large IP ranges because it uses asynchronous transmission and can scan the entire IPv4 address space in under 10 minutes at a rate of 10 million packets per second. It minimizes network traffic by sending only SYN packets and not completing the TCP handshake, making it ideal for rapid live host detection without overwhelming the network.

Answer

Maltego

Answer

dnsenum

Answer

Nessus

Question 8

Which Google dork would a penetration tester use to find login pages that are indexed by Google?

Accepted Answer

inurl:login. The Google dork 'inurl:login' specifically searches for URLs containing the word 'login', which commonly appear in login page paths (e.g., /login.php, /login.aspx). This allows a penetration tester to quickly identify indexed login portals for further reconnaissance, such as testing for default credentials or brute-force attacks.

Answer

filetype:xls username password

Answer

intitle:"index of"

Answer

site:example.com intext:password

Question 9

During a security assessment, a tester uses `nmap -sU 192.168.1.1`. What type of scan does this command perform?

Accepted Answer

UDP scan. The `-sU` flag in Nmap explicitly instructs the tool to perform a UDP scan. This sends UDP packets to the target ports and analyzes responses (or lack thereof) to determine if a UDP port is open, closed, or filtered. Unlike TCP, UDP is connectionless, so the scan relies on ICMP unreachable messages or lack of response to infer port status.

Answer

TCP SYN scan

Answer

Ping sweep

Answer

OS fingerprinting

Question 10

A penetration tester is scanning a target and receives the output: 'PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https'. Which Nmap flag was MOST likely used to obtain this output?

Accepted Answer

-sS. The output shows open ports with their service names (ssh, http, https) but no version information. The -sS flag performs a SYN stealth scan, which by default probes common ports and uses the /etc/services file to map port numbers to service names. This matches the output format exactly, as -sS does not perform version detection or OS fingerprinting.

Answer

-O

Answer

-A

Answer

-sV

Question 11

An attacker sends a TCP SYN packet to a port and receives a TCP RST packet in response. According to Nmap's port state classification, what is the state of this port?

Accepted Answer

Closed. When Nmap sends a TCP SYN packet to a port and receives a TCP RST packet in response, it indicates that the port is reachable but no service is listening on it. Per RFC 793, a RST is sent when a SYN arrives on a closed port, so Nmap classifies this port as 'closed'.

Answer

Filtered

Answer

Unfiltered

Answer

Open

Question 12

During a reconnaissance phase, a tester uses `dnsrecon -d example.com -t axfr`. What specific DNS query is being attempted?

Accepted Answer

A zone transfer request. The `-t axfr` flag in `dnsrecon` specifies a zone transfer request (AXFR). This query attempts to retrieve the entire DNS zone file from a nameserver, which can reveal all DNS records for the domain. A successful zone transfer is a critical misconfiguration because it exposes internal network topology and hostnames.

Answer

A subdomain brute-force

Answer

A reverse DNS lookup

Answer

A SRV record enumeration

Question 13

A security analyst wants to perform passive reconnaissance on a target domain. Which TWO of the following methods are considered passive? (Choose 2)

Accepted Answer

WHOIS lookup. WHOIS lookup is passive because it queries public registration databases (e.g., ARIN, RIPE) via the WHOIS protocol (RFC 3912) to retrieve domain ownership, registrar, and name server information without sending any packets to the target's own infrastructure. This data is publicly available and does not interact with the target's servers or network, making it a classic passive reconnaissance technique.

Answer

Telnet banner grab

Answer

Ping sweep

Answer

Nmap SYN scan

Question 14

Which THREE of the following are examples of OSINT techniques? (Choose 3)

Accepted Answer

Shodan search. Shodan is a search engine for internet-connected devices, allowing users to discover open ports, services, and banners without directly interacting with the target. This is a classic OSINT technique because it gathers publicly available information from external sources, not from active scanning of the target's own infrastructure.

Answer

Nmap version detection

Answer

Nessus vulnerability scan

Question 15

A security analyst wants to gather information about a target domain without directly interacting with its systems. Which technique would be MOST appropriate?

Accepted Answer

Query WHOIS databases for domain registration information. Querying WHOIS databases is a passive reconnaissance technique that retrieves publicly available domain registration information (e.g., registrar, creation/expiration dates, name servers, and administrative contacts) without sending any packets to the target's systems. This aligns with the goal of gathering information without direct interaction, as defined in the CEH footprinting phase.

Answer

Send ICMP echo requests to the target network

Answer

Run a vulnerability scan with Nessus

Answer

Perform a port scan using Nmap SYN scan