CEH Footprinting, Reconnaissance and Scanning Practice Test 6 — 15 Questions

Question 1

A penetration tester uses the following Google dork: site:example.com filetype:pdf inurl:confidential. What is the MOST likely goal of this search?

Accepted Answer

Find PDF files on example.com that have 'confidential' in their filename or path. The Google dork `site:example.com filetype:pdf inurl:confidential` combines the `site` operator to restrict results to example.com, `filetype:pdf` to filter for PDF files, and `inurl:confidential` to require that the URL or path contains the word 'confidential'. This targets PDF files whose filename or directory path includes 'confidential', making option C correct. The `inurl` operator matches the URL string, not the file content, so it does not search within the PDF text.

Answer

Retrieve all PDF files from example.com regardless of content

Answer

Identify all web pages on example.com that link to PDF files

Answer

Discover PDF files that contain the word 'confidential' on example.com

Question 2

During a security assessment, a tester runs hping3 with the command: hping3 -S -p 80 -c 5 10.0.0.1. The response shows that packets with the SYN flag set receive SYN-ACK replies. Which of the following conclusions is MOST accurate?

Accepted Answer

Port 80 is open on 10.0.0.1. The hping3 command with the -S flag sends TCP SYN packets to port 80 on 10.0.0.1. Receiving SYN-ACK replies indicates that the target responded with the second step of the TCP three-way handshake, which only occurs when the port is open and listening. This confirms that port 80 is open on the target host.

Answer

A firewall is blocking the scan

Answer

Port 80 is closed on 10.0.0.1

Answer

The target is using a stateful firewall that allows the connection

Question 3

A security analyst wants to identify all live hosts on a network without generating excessive traffic. Which of the following techniques is MOST appropriate for this purpose?

Accepted Answer

Ping sweep using ICMP echo requests. A ping sweep using ICMP Echo Requests (Type 8) is the most efficient method to identify live hosts on a network because it sends a single packet per target and listens for ICMP Echo Replies (Type 0). This generates minimal traffic compared to full port scans, making it ideal for initial reconnaissance without overwhelming the network or triggering intrusion detection systems.

Answer

Banner grabbing with Netcat

Answer

Full TCP connect scan on all ports

Answer

UDP scan on common ports

Question 4

A security engineer is concerned about DNS zone transfer attacks. Which of the following countermeasures would be MOST effective in preventing unauthorized zone transfers?

Accepted Answer

Restrict zone transfers to authorized IP addresses only. Restricting zone transfers to authorized IP addresses only is the most effective countermeasure because it directly controls which DNS servers are allowed to request a full copy of the zone data. By configuring an allow-transfer list (e.g., using the 'allow-transfer { trusted_servers; };' directive in BIND), the primary DNS server will reject zone transfer requests from any unauthorized IP, preventing attackers from enumerating all DNS records.

Answer

Use DNSSEC to sign the zone

Answer

Change the default port of 53 to a non-standard port

Answer

Disable DNS recursion on the server

Question 5

A penetration tester receives the following output from a tool: 'Starting dnsrecon.py -d example.com -t axfr' and then a list of all DNS records. Which of the following BEST describes what occurred?

Accepted Answer

A successful DNS zone transfer was performed, revealing all DNS records for the domain. The output shows the dnsrecon tool being run with the '-t axfr' option, which specifically requests a DNS zone transfer (AXFR). A zone transfer is a mechanism for replicating DNS databases across DNS servers, and if misconfigured, it allows an attacker to retrieve all DNS records for a domain. The successful listing of all DNS records confirms that the zone transfer was permitted by the target's DNS server, revealing the entire DNS zone.

Answer

A DNSSEC validation check was completed

Answer

A DNS cache snooping attack was executed

Answer

A reverse DNS lookup was performed to find domain names from IP addresses

Question 6

An analyst wants to perform a SYN flood attack test against a server to evaluate its resilience. Which of the following tools would be the MOST appropriate for this task?

Accepted Answer

hping3. hping3 is the most appropriate tool because it is a command-line packet crafting tool that allows the user to generate custom TCP SYN packets with spoofed source IP addresses, making it ideal for simulating a SYN flood attack. Unlike other tools, hping3 can send a high volume of SYN packets without completing the three-way handshake, which is the core mechanism of a SYN flood that exhausts the server's connection queue.

Answer

Nmap

Answer

Shodan

Answer

Wireshark

Question 7

During a penetration test, a tester uses Nmap with the command: nmap -sS -D RND:10 192.168.1.100. After the scan, the IDS logs show multiple SYN packets from different source IPs hitting the target. However, the tester's true IP is not among them. Which of the following techniques is being used?

Accepted Answer

Decoy scan. The command `nmap -sS -D RND:10` performs a SYN stealth scan with 10 randomly generated decoy IP addresses. The IDS logs show multiple SYN packets from different source IPs, but the tester's true IP is not among them because Nmap sends the decoy packets with spoofed source addresses while the real scan packet is interleaved among them. This is the definition of a decoy scan, which aims to obscure the attacker's true origin by blending it with fake sources.

Answer

Idle scan

Answer

SYN flood

Answer

Fragmentation attack

Question 8

Which of the following tools is specifically designed to search the internet for exposed devices and services, such as industrial control systems and webcams, using banners and metadata?

Accepted Answer

Shodan. Shodan is a search engine specifically designed to scan the internet for exposed devices and services by collecting banners and metadata from protocols such as HTTP, SSH, FTP, and SNMP. Unlike general-purpose search engines, Shodan indexes device-specific information, making it ideal for discovering industrial control systems (ICS), webcams, and other IoT devices that respond to network probes.

Answer

Maltego

Answer

Nmap

Answer

Google

Question 9

A penetration tester runs the following command: masscan 10.0.0.0/24 -p80,443,8080 --rate=10000. Compared to Nmap, what is the PRIMARY advantage of using Masscan for this scan?

Accepted Answer

Masscan can scan a large number of hosts and ports at very high speed. Masscan is designed for asynchronous, high-speed scanning, capable of transmitting packets at rates exceeding 10 million packets per second. In this command, the `--rate=10000` parameter sets a transmission rate of 10,000 packets per second, allowing it to scan the entire 10.0.0.0/24 subnet (256 hosts) for three ports in a fraction of the time Nmap would require. Nmap, while feature-rich, operates synchronously by default and cannot match Masscan's raw packet throughput for large-scale port scanning.

Answer

Masscan provides more detailed service version detection than Nmap

Answer

Masscan is stealthier than Nmap and less likely to be detected

Answer

Masscan can scan all 65535 ports faster than Nmap

Question 10

Which THREE of the following Nmap flags are commonly used for evasion techniques? (Select 3)

Accepted Answer

-f. The -f flag fragments the probe packets into smaller 8-byte fragments (or less, depending on the MTU). This helps evade simple packet-filtering firewalls and intrusion detection systems that do not reassemble fragments before applying rules, as the fragmented headers may bypass signature-based detection.

Answer

-O

Answer

-sV

Question 11

Which TWO of the following are valid port states that Nmap can report? (Select 2)

Accepted Answer

Open. Nmap reports a port as Open (option C) when a TCP SYN/connect scan or UDP probe receives a response indicating a service is actively listening on that port, making it one of the six standard states (open, closed, filtered, unfiltered, open|filtered, closed|filtered). Nmap reports a port as Filtered (option D) when packet filtering (e.g., a firewall dropping packets) prevents Nmap from determining whether the port is open or closed, typically resulting in no response or an ICMP unreachable error. The other options are not part of Nmap's port state vocabulary: 'Unknown' (A) is not a state Nmap outputs, 'Secured' (B) is not an Nmap state, and 'Blocked' (E) is not used by Nmap—filtering is the term Nmap uses instead.

Answer

Unknown

Answer

Secured

Answer

Blocked

Question 12

A security analyst wants to gather information about a target domain using publicly available sources without directly interacting with the target’s systems. Which type of reconnaissance is being performed?

Accepted Answer

Passive reconnaissance. Passive reconnaissance involves collecting information about a target from publicly available sources without sending any packets or making direct contact with the target's systems. This approach relies on open-source intelligence (OSINT) such as WHOIS records, DNS lookups, search engines, and social media, ensuring no footprint is left on the target's network.

Answer

Vulnerability scanning

Answer

Social engineering

Answer

Active reconnaissance

Question 13

Which command-line tool is specifically designed to extract email addresses, subdomains, and other information from public sources (e.g., search engines, social media) for a given domain?

Accepted Answer

theHarvester. theHarvester is a dedicated open-source intelligence (OSINT) tool designed to gather emails, subdomains, IPs, and employee names from public sources such as Google, Bing, LinkedIn, and PGP key servers. It specifically targets a given domain and queries search engines and social media APIs to extract this reconnaissance data, making it the correct choice for this task.

Answer

Metasploit

Answer

Nmap

Answer

Wireshark

Question 14

During a penetration test, a tester runs 'dnsrecon -d example.com -t axfr' and receives a full list of DNS records. What does this indicate about the target's DNS configuration?

Accepted Answer

The DNS server allows zone transfers from any host. The 'dnsrecon -d example.com -t axfr' command performs a DNS zone transfer (AXFR) request. Receiving a full list of DNS records indicates that the target DNS server is misconfigured to allow zone transfers from any host, which exposes the entire DNS zone data (including internal hostnames and IP addresses) to unauthorized parties. This is a critical information disclosure vulnerability.

Answer

The DNS server has DNSSEC enabled

Answer

The DNS server allows recursive queries

Answer

The DNS server is authoritative for the domain

Question 15

An analyst executes 'nmap -sU -p 161,162 10.0.0.1'. What is the primary purpose of this scan?

Accepted Answer

Discover SNMP services running on the target. The `-sU` flag instructs Nmap to perform a UDP scan, and the `-p 161,162` targets the default SNMP ports (UDP 161 for SNMP queries, UDP 162 for SNMP traps). This combination is specifically designed to discover SNMP services running on the target host, as SNMP operates exclusively over UDP. Option C is correct because the command's primary purpose is to probe for SNMP services.

Answer

Detect TCP services on the target

Answer

Enumerate all open ports on the target

Answer

Perform a SYN flood attack