CEH Footprinting, Reconnaissance and Scanning Practice Test 5 — 15 Questions

Question 1

During a security assessment, you execute: dnsenum --enum example.com. The tool returns results including the nameservers (NS), mail servers (MX), and performs a zone transfer attempt. The zone transfer fails. What is the MOST likely reason for the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The DNS server is configured to deny zone transfers from unauthorized hosts. DNS zone transfers (AXFR) are typically restricted by default on authoritative DNS servers to prevent unauthorized disclosure of the entire zone file. The `dnsenum` tool attempts an AXFR query over TCP port 53, and the failure indicates the server explicitly denied the request, which is a standard security configuration per RFC 5936.

Answer

The DNS server is not running

Answer

The zone transfer requires TCP port 443

Answer

The domain does not exist

Question 2

Which of the following best describes the difference between active and passive reconnaissance?

Accepted Answer

Active reconnaissance involves direct interaction with the target, whereas passive reconnaissance does not. Active reconnaissance involves direct interaction with the target system, such as sending packets, probes, or connection requests (e.g., using Nmap scans, ping sweeps, or banner grabbing) that can be logged or detected by the target. Passive reconnaissance, in contrast, gathers information without engaging the target directly, relying on publicly available sources (e.g., WHOIS lookups, DNS records, social media, or search engines) and does not generate traffic that reaches the target's network. This distinction is fundamental in the CEH methodology because active techniques carry a higher risk of alerting the target, while passive techniques are stealthier and often used first to avoid detection.

Answer

Active reconnaissance is legal, while passive reconnaissance is not

Answer

Passive reconnaissance uses tools like Nmap, while active reconnaissance uses Google dorks

Answer

Passive reconnaissance is used only during the exploitation phase

Question 3

A security analyst runs the following command: hping3 -S -p 80 -c 1 192.168.1.1. The response received is an RST/ACK packet. What does this indicate about port 80 on the target?

Accepted Answer

The port is closed. When hping3 sends a SYN packet to a closed port, the target responds with an RST/ACK packet per TCP RFC 793. This indicates that the port is reachable but no service is listening on it, hence the immediate reset.

Answer

The port is open and listening

Answer

The port is filtered by a firewall

Answer

The port is in a TIME_WAIT state

Question 4

Which Google dork query would an attacker most likely use to find login pages on a web server?

Accepted Answer

intitle:login. The Google dork 'intitle:login' specifically searches for web pages where the word 'login' appears in the HTML title tag. Attackers use this to quickly discover login portals, as many web applications include 'login' in the page title, making it a reliable footprinting technique for identifying authentication interfaces.

Answer

inurl:admin

Answer

site:example.com filetype:pdf

Answer

link:example.com

Question 5

A penetration tester uses the following Nmap command: nmap -sS -O -p 1-1000 10.0.0.1. The output shows port 22 as open, and OS detection suggests 'Linux 2.6.x'. The tester then runs: nmap -sV -p 22 10.0.0.1. What additional information does the second scan provide?

Accepted Answer

It identifies the version of the SSH service running. The second scan uses the `-sV` flag, which enables version detection. Nmap probes the open port 22 (SSH) to determine the exact service version (e.g., OpenSSH 5.3p1). This is distinct from OS detection (`-O`), which guesses the operating system based on TCP/IP stack fingerprinting. The `-sV` scan provides granular service version information, not OS confirmation or firewall status.

Answer

It confirms the OS is Linux 2.6.x

Answer

It checks if the port is filtered by a firewall

Answer

It performs a UDP scan on port 22

Question 6

What is the primary purpose of using the Nmap flag -sS?

Accepted Answer

Perform a SYN stealth scan. The Nmap flag -sS instructs Nmap to perform a SYN stealth scan, also known as a half-open scan. It sends a TCP SYN packet to the target port and, if a SYN/ACK is received, the port is considered open; the scanner then sends a RST to tear down the connection before the full TCP three-way handshake completes. This technique avoids completing the connection, making it less likely to be logged by the target's application layer and is the default scan type when run with root privileges.

Answer

Enable OS detection

Answer

Perform a UDP scan

Answer

Perform a TCP connect scan

Question 7

A security analyst receives an alert that an external IP address is sending fragmented packets to the company's web server on port 80. The analyst suspects the attacker is using Nmap with fragmentation. Which Nmap flag is being used to fragment the probe packets?

Accepted Answer

-f. The -f flag in Nmap instructs the tool to fragment the probe packets into 8-byte or smaller fragments, making it harder for packet filters and intrusion detection systems to detect the scan. This matches the scenario where fragmented packets are sent to the web server on port 80, confirming that -f is the correct flag.

Answer

-sI

Answer

-D

Answer

--mtu

Question 8

Which of the following tools would be BEST to use for identifying all live hosts in a large IP range (e.g., 10.0.0.0/8) quickly?

Accepted Answer

Masscan. Masscan is the best choice because it is designed for high-speed scanning across large IP ranges, capable of transmitting packets at rates exceeding 10 million packets per second. It uses asynchronous transmission and raw sockets to quickly identify live hosts by sending SYN probes and analyzing responses, making it ideal for scanning a /8 subnet (16.7 million addresses) in minutes.

Answer

OpenVAS

Answer

Nmap with -sL flag

Answer

hping3

Question 9

Which TWO of the following are passive reconnaissance techniques?

Accepted Answer

Google hacking (dorking). Google hacking (dorking) is a passive reconnaissance technique because it involves using advanced search operators in Google to discover publicly indexed information about a target, such as exposed configuration files or login pages, without sending any packets directly to the target's systems. It relies entirely on the search engine's pre-existing index, making it undetectable and non-intrusive. Similarly, WHOIS lookup is a passive reconnaissance technique because it queries public WHOIS databases to retrieve domain registration information, such as registrant details, name servers, and expiration dates, without directly interacting with the target's own infrastructure. Both techniques align with the CEH definition of passive reconnaissance, where no direct interaction with the target occurs.

Answer

Ping sweep

Answer

Nmap SYN scan

Answer

Banner grabbing with Netcat

Question 10

Which THREE of the following are correct statements about DNS zone transfers?

Accepted Answer

A successful zone transfer reveals all DNS records for the domain. A successful DNS zone transfer (AXFR) returns the complete zone file, which contains all DNS records for the domain, including A, AAAA, MX, CNAME, NS, and TXT records. This is why it is a critical information-gathering step during reconnaissance.

Answer

Zone transfers are encrypted by default

Answer

Zone transfers use UDP port 53

Question 11

Which TWO of the following Nmap scans are considered 'stealth' scans that do not complete a full TCP three-way handshake?

Accepted Answer

FIN scan (-sF). A FIN scan (-sF) sends a TCP packet with only the FIN flag set. According to RFC 793, if the port is closed, the target responds with an RST packet; if open, the packet is ignored. This avoids completing a full TCP three-way handshake, making it a stealth scan.

Answer

TCP connect scan (-sT)

Answer

UDP scan (-sU)

Answer

ACK scan (-sA)

Question 12

A security analyst runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?

Accepted Answer

Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting. The command `nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24` performs a TCP SYN scan (`-sS`) on only the four specified ports, enables service version detection (`-sV`), and attempts OS fingerprinting (`-O`). This is a stealthy half-open scan that does not complete the TCP three-way handshake, combined with banner grabbing and OS detection, limited to the given port list.

Answer

Perform an aggressive scan of all open ports and enumerate SMB shares

Answer

Perform a UDP scan on the four specified ports and identify running services

Answer

Perform a full TCP connect scan with UDP service detection on all ports

Question 13

During a penetration test, a tester wants to gather email addresses, subdomains, and employee names associated with a target domain. Which of the following tools is specifically designed for such passive reconnaissance?

Accepted Answer

theHarvester. theHarvester is a passive reconnaissance tool specifically designed to gather email addresses, subdomains, employee names, and other open-source intelligence (OSINT) from public sources such as search engines (Google, Bing), PGP key servers, and the Shodan database. It operates without sending direct packets to the target, making it ideal for passive footprinting as defined in the CEH methodology.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 14

A security team detects unusual outbound traffic from a host that appears to be a reverse shell. Which of the following Nmap features would be MOST effective for identifying the service running on the listening port of the command-and-control server?

Accepted Answer

Service version detection using the -sV flag. The -sV flag instructs Nmap to perform service version detection by probing open ports and analyzing the responses to determine the exact application and version running on the listening port. In a reverse shell scenario, identifying the service (e.g., a specific SSH, HTTP, or custom listener) on the C2 server is critical for understanding the attack vector and planning remediation.

Answer

UDP scan using the -sU flag

Answer

Nmap Scripting Engine (NSE) with the http-enum script

Answer

OS fingerprinting using the -O flag

Question 15

A penetration tester uses the following Google dork: site:example.com filetype:pdf inurl:confidential. What is the MOST likely goal of this search?

Accepted Answer

Find PDF files on example.com that have 'confidential' in their filename or path. The Google dork `site:example.com filetype:pdf inurl:confidential` combines the `site` operator to restrict results to example.com, `filetype:pdf` to filter for PDF files, and `inurl:confidential` to require that the URL or path contains the word 'confidential'. This targets PDF files whose filename or directory path includes 'confidential', making option C correct. The `inurl` operator matches the URL string, not the file content, so it does not search within the PDF text.

Answer

Retrieve all PDF files from example.com regardless of content

Answer

Identify all web pages on example.com that link to PDF files

Answer

Discover PDF files that contain the word 'confidential' on example.com