CEH Footprinting, Reconnaissance and Scanning Practice Test 7 — 15 Questions

Question 1

While performing reconnaissance, a tester uses a Google dork to find login pages exposed on the internet. Which of the following is an example of a Google dork that could be used for this purpose?

Accepted Answer

inurl:login.php. The Google dork 'inurl:login.php' instructs Google to return only URLs that contain the string 'login.php' in the URL path. This is a classic reconnaissance technique to discover exposed login pages, as many web applications use 'login.php' as the default authentication endpoint. The 'inurl:' operator filters search results based on the literal text in the URL, making it ideal for footprinting specific web resources.

Answer

site:example.com -www

Answer

filetype:pdf

Answer

link:example.com

Question 2

A penetration tester runs 'nmap -sS -p 80 --script http-title 192.168.1.100' and receives output indicating port 80 is 'filtered'. What does the 'filtered' state imply?

Accepted Answer

A firewall is likely blocking the probe packets. The 'filtered' state in Nmap indicates that the probe packets (SYN packets for a SYN scan) were dropped or did not elicit any response, typically due to a firewall or packet filter. Since no SYN/ACK or RST was received, Nmap cannot determine if the port is open or closed, so it marks it as 'filtered'. This is distinct from an 'open' state (SYN/ACK received) or 'closed' state (RST received).

Answer

The port is open and a service is listening

Answer

The service is running but the script failed

Answer

The port is closed and no service is listening

Question 3

An attacker uses an idle scan with Nmap to probe a target. This technique relies on a third-party host with a predictable IP ID sequence to infer port states. Which Nmap flag enables an idle scan?

Accepted Answer

-sI. The idle scan (-sI) leverages a third-party host (zombie) with a predictable IP ID sequence to indirectly probe a target's ports. By spoofing the zombie's IP and observing changes in its IP ID counter, Nmap can infer whether a port is open, closed, or filtered without sending packets directly from the attacker's IP.

Answer

-sS

Answer

-sA

Answer

-sT

Question 4

A security analyst is asked to perform a fast scan of a large network (e.g., /16 subnet) to identify live hosts. Which tool is MOST suitable for this task due to its high speed?

Accepted Answer

Masscan. Masscan is the most suitable tool for this task because it is designed specifically for high-speed scanning of large address spaces, such as a /16 subnet (65,536 hosts). It uses asynchronous transmission and can send packets at rates exceeding 10 million packets per second, making it significantly faster than Nmap for raw host discovery across massive ranges.

Answer

hping3

Answer

Nmap

Answer

Wireshark

Question 5

Which of the following techniques involves sending crafted packets to a target to elicit responses that reveal the operating system?

Accepted Answer

Active OS fingerprinting. Active OS fingerprinting involves sending crafted packets (e.g., TCP SYN, FIN, or ICMP probes) to a target and analyzing the responses to deduce the operating system. Unlike passive methods, it actively interacts with the target, leveraging subtle differences in how various OSes implement TCP/IP stack behaviors (e.g., initial TTL values, window sizes, or TCP option ordering). This technique is commonly used by tools like Nmap with its `-O` flag.

Answer

Passive OS fingerprinting

Answer

Banner grabbing

Answer

DNS enumeration

Question 6

An incident responder notices unusual outbound traffic from a host that is communicating with an external IP on port 4444. The traffic appears to be encrypted. Which tool could be used to initiate a connection to that external IP to gather a banner for service identification?

Accepted Answer

Telnet. Telnet can be used to connect to any TCP port, including port 4444, to manually interact with a service and retrieve its banner. Banners often reveal the service name, version, and other identifying information, which is critical for footprinting and reconnaissance. Even though the traffic is encrypted, the initial banner may be sent in cleartext before encryption begins, or the connection attempt itself can reveal the service type.

Answer

traceroute

Answer

nslookup

Answer

ping

Question 7

A security analyst runs a vulnerability scan with Nessus and receives a report indicating that multiple hosts have the 'MS17-010' vulnerability. What is the MOST likely impact of this vulnerability if exploited?

Accepted Answer

Remote code execution on Windows systems. MS17-010 is a critical remote code execution vulnerability in the Microsoft Server Message Block (SMB) protocol. Exploitation allows an unauthenticated attacker to send specially crafted packets to an SMB server, enabling arbitrary code execution with system privileges. This is the same vulnerability leveraged by the EternalBlue exploit used in the WannaCry ransomware attacks.

Answer

SQL injection

Answer

Cross-site scripting

Answer

DNS cache poisoning

Question 8

Which TWO of the following Nmap flags are used for evasion of IDS/IPS? (Choose two.)

Accepted Answer

-D. (-D) is correct because the Nmap decoy scan flag allows you to spoof multiple source IP addresses, making it difficult for IDS/IPS to distinguish the real scanning host from decoys. Option D (-f) is correct because fragmenting packets (e.g., using -f to split TCP headers into 8-byte fragments) evades signature-based detection by bypassing pattern-matching rules that expect complete packet headers.

Answer

-sV

Answer

-O

Answer

-sT

Question 9

Which THREE of the following are common techniques used during the footprinting phase? (Choose three.)

Accepted Answer

WHOIS lookup. WHOIS lookup is a footprinting technique that queries domain registration databases (e.g., whois.arin.net) to obtain registrant contact details, name servers, and registration dates. Google hacking (also known as Google dorking) uses advanced search operators to uncover sensitive information indexed by search engines, such as exposed configuration files or login pages. DNS zone transfer (AXFR) is a footprinting technique that, if misconfigured, allows an attacker to retrieve a complete list of DNS records for a domain, revealing internal hostnames and network structure. All three are passive or semi-passive information-gathering methods performed without directly engaging the target's systems.

Answer

Exploitation

Answer

Port scanning

Question 10

During a penetration test, you run the command: nmap -sU -p 161,162 --script=snmp-brute 192.168.1.100. Which of the following is the PRIMARY goal of this scan?

Accepted Answer

Discover SNMP community strings via brute-force. The command uses the `-sU` flag for a UDP scan and targets ports 161 and 162, which are the standard SNMP ports. The `--script=snmp-brute` script attempts to brute-force SNMP community strings (the equivalent of passwords for SNMPv1/v2c). Therefore, the primary goal is to discover valid community strings, which is option A.

Answer

Perform a ping sweep to discover live hosts

Answer

Identify open TCP ports and services on the target

Answer

Enumerate SNMP MIB tree values

Question 11

A security analyst notices that their Nmap scan results show all ports as 'filtered' despite the target host being alive and responsive to ping. Which of the following is the MOST likely cause?

Accepted Answer

The target has a host-based firewall that drops all incoming traffic silently. When an Nmap scan shows all ports as 'filtered', it indicates that the target is reachable (since ping succeeds) but the probe packets (e.g., SYN, ACK) are being dropped without any response. A host-based firewall configured to silently drop all incoming traffic is the most likely cause, as it prevents Nmap from receiving RST or SYN/ACK replies, leading to the 'filtered' state for every port.

Answer

The analyst's machine has a misconfigured routing table

Answer

The target is running a honeypot that mimics multiple services

Answer

The target is an idle host that does not respond to any traffic

Question 12

Which of the following Google dorks would an attacker MOST likely use to find login pages of web applications that are publicly accessible?

Accepted Answer

intitle:login. The Google dork 'intitle:login' is most effective for finding login pages because it searches for the word 'login' in the HTML title tag of web pages. Attackers use this to quickly identify publicly accessible authentication portals, which are common entry points for brute-force or credential-stuffing attacks. This dork directly targets the page title, a standard HTML element that often contains the word 'login' on authentication pages.

Answer

inurl:robots.txt

Answer

filetype:pdf

Answer

cache:example.com

Question 13

During a reconnaissance phase, a penetration tester uses Shodan to search for devices with a specific open port. Which of the following BEST describes what Shodan provides beyond a simple port scan?

Accepted Answer

Banner information and service metadata from internet-connected devices. Shodan is a search engine for internet-connected devices that actively probes IP addresses and collects banner information—the metadata that services (e.g., HTTP, SSH, FTP) return upon connection. This includes server headers, version strings, default credentials, and other service fingerprints, which goes far beyond a simple port scan that only reports whether a port is open or closed.

Answer

Real-time network traffic analysis

Answer

Passive DNS records and domain registration details

Answer

Historical vulnerability data for each device

Question 14

A security analyst runs the Nmap command: nmap -sI 192.168.1.50 -p 80 10.0.0.1. The scan completes, but the target shows no open ports. What is the MOST likely explanation?

Accepted Answer

The zombie host is not truly idle, causing false results. The -sI flag in Nmap performs an idle scan, which relies on a zombie host (192.168.1.50) with a globally predictable IP ID sequence to probe the target. If the zombie host is not truly idle—meaning it is sending or receiving other traffic during the scan—its IP ID values will increment unpredictably, corrupting the side-channel analysis and causing Nmap to report all ports as filtered or closed. This is the most likely reason for the false 'no open ports' result.

Answer

The analyst used the wrong port number

Answer

The target has a firewall blocking the decoy packets

Answer

The target host is offline

Question 15

A penetration tester wants to perform a ping sweep on a /24 subnet to identify live hosts. Which command would accomplish this efficiently?

Accepted Answer

nmap -sn 192.168.1.0/24. `nmap -sn` performs a ping sweep (host discovery) without port scanning, sending ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default. This efficiently identifies live hosts on a /24 subnet without the overhead of port scanning or OS detection.

Answer

nmap -O 192.168.1.0/24

Answer

nmap -p- 192.168.1.0/24

Answer

nmap -sV 192.168.1.0/24