CEH Footprinting, Reconnaissance and Scanning Practice Test 8 — 15 Questions

Question 1

A security analyst performs a passive reconnaissance of a target domain using public resources. Which of the following techniques would be considered passive reconnaissance?

Accepted Answer

Performing a WHOIS lookup for the target domain. Passive reconnaissance involves gathering information without directly interacting with the target's systems, thus avoiding any network traffic that could be detected. A WHOIS lookup queries a public registry database (e.g., whois.arin.net) over port 43 or via a web interface, retrieving domain registration details without sending any packets to the target's own infrastructure. This makes it a purely passive technique.

Answer

Using Netcat to grab banners from the target's email server

Answer

Running Nmap SYN scan on the target's web server

Answer

Sending a ping sweep to the target's public IP range

Question 2

During a penetration test, the tester wants to discover all subdomains of a target domain using an OSINT technique. Which tool is specifically designed for subdomain enumeration via search engines and public records?

Accepted Answer

theHarvester. theHarvester is specifically designed to perform OSINT-based subdomain enumeration by querying search engines (e.g., Google, Bing) and public data sources (e.g., PGP key servers, DNSDumpster). It collects email addresses, subdomains, IPs, and virtual hosts without direct interaction with the target's infrastructure, making it ideal for passive reconnaissance.

Answer

Maltego

Answer

Shodan

Answer

dnsrecon

Question 3

A security analyst notices a large number of incomplete TCP connections (SYN_RECV) on a server. Which Nmap scan type is the MOST likely cause of this symptom?

Accepted Answer

SYN scan (-sS). A SYN scan (-sS) sends a SYN packet to initiate a TCP handshake and, upon receiving a SYN/ACK, sends a RST to tear down the connection before it completes. This leaves the server with half-open connections in the SYN_RECV state because the three-way handshake is never finished. The large number of incomplete connections directly matches the behavior of a SYN scan.

Answer

Ping sweep (-sn)

Answer

TCP Connect scan (-sT)

Answer

UDP scan (-sU)

Question 4

A penetration tester uses the following Google dork: intitle:"index of" "backup" site:example.com. What is the MOST likely goal of this search?

Accepted Answer

Locate open directories that might contain sensitive files. The Google dork `intitle:"index of" "backup" site:example.com` targets web servers that have directory listing enabled (indicated by the page title containing 'index of') and that contain a folder or file named 'backup'. This is a classic reconnaissance technique to find open directories where backup files (e.g., database dumps, configuration files) may be inadvertently exposed, potentially containing sensitive data such as credentials or proprietary information.

Answer

Discover email addresses associated with the domain

Answer

Find login pages of the target domain

Answer

Identify subdomains of example.com

Question 5

An analyst runs the following command: dnsenum --enum example.com. Which of the following actions is dnsenum performing?

Accepted Answer

Attempts a zone transfer and brute-forces subdomains. The `dnsenum` tool is designed for DNS enumeration, and its `--enum` flag performs a comprehensive scan that includes attempting a zone transfer (AXFR query) to retrieve all DNS records from the nameserver, and if that fails, it brute-forces subdomains using a wordlist. This matches option A exactly.

Answer

Scans for open ports on the DNS server

Answer

Queries the DNS server for its version information

Answer

Performs a reverse DNS lookup to find PTR records for the IP range

Question 6

Which Nmap flag is used to perform a TCP SYN scan without completing the three-way handshake?

Accepted Answer

-sS. The -sS flag instructs Nmap to perform a TCP SYN scan, which sends a SYN packet to the target port and, upon receiving a SYN/ACK response, sends an RST packet instead of completing the three-way handshake with an ACK. This allows the scanner to determine port states without establishing a full TCP connection, making it faster and less detectable than a full connect scan.

Answer

-sT

Answer

-sU

Answer

-sA

Question 7

During a penetration test, the tester needs to identify the operating system of a remote host without sending any packets to it. Which technique should the tester use?

Accepted Answer

Passive OS fingerprinting using captured packets. Passive OS fingerprinting (Option B) is correct because it analyzes captured network traffic—such as TCP/IP packet headers, TTL values, window sizes, and DF flags—to infer the remote host's operating system without sending any packets. This technique relies on subtle differences in how various OS stacks implement RFC 793, making it ideal for stealthy reconnaissance where no direct contact with the target is permitted.

Answer

Banner grabbing with Telnet

Answer

Querying Shodan for the target IP

Answer

Active OS fingerprinting with Nmap -O

Question 8

A security analyst runs the command: nmap -sS -p 80,443,8080 --script http-headers scanme.nmap.org. The output shows that port 80 is filtered. What does 'filtered' mean in this context?

Accepted Answer

A firewall or IDS is preventing the probe from reaching the port. In Nmap, a 'filtered' port status indicates that the port is being blocked by a firewall, IDS, or other network filtering device, preventing the probe from reaching the target service. The -sS (SYN stealth scan) sends a SYN packet; if no response is received or an ICMP unreachable (type 3, code 13) is returned, Nmap marks the port as filtered. This does not mean the port is open or closed—it means the scan could not determine the state due to filtering.

Answer

The port is open, but the service is not responding

Answer

The port is open and actively listening

Answer

The port is closed, but the target is responding with RST packets

Question 9

Which of the following tools is specifically designed for high-speed port scanning across large address spaces?

Accepted Answer

Masscan. Masscan is specifically designed for high-speed port scanning across large address spaces, capable of transmitting packets at rates exceeding 10 million packets per second. It achieves this by using asynchronous transmission and a custom TCP/IP stack, making it ideal for scanning the entire IPv4 internet or massive subnets in minutes, unlike general-purpose scanners that prioritize accuracy over raw speed.

Answer

Zenmap

Answer

hping3

Answer

Nmap

Question 10

A penetration tester wants to evade an IDS while scanning a target network. The tester uses the Nmap command: nmap -sS -f 10.10.10.1. What does the -f flag accomplish?

Accepted Answer

It fragments the IP packets into 8-byte fragments. The -f flag in Nmap instructs the tool to fragment the IP packets into 8-byte fragments (or smaller, depending on the MTU). This is a common evasion technique used to bypass Intrusion Detection Systems (IDS) and firewalls by splitting the TCP header across multiple packets, making it harder for signature-based detection to reassemble and match the scan pattern.

Answer

It increases the timing template to T5 (insane)

Answer

It uses an idle scan by bouncing off a zombie host

Answer

It sends packets with a spoofed source IP address

Question 11

A security analyst observes the following Nmap output for a target host: PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https. The analyst then runs a version detection scan and notices that port 80 reports 'Apache httpd 2.4.41' but port 443 reports 'Apache httpd 2.4.41' as well. What is the MOST likely conclusion?

Accepted Answer

The target is likely running a single web server that handles both HTTP and HTTPS traffic. Option B is correct because when both port 80 (HTTP) and port 443 (HTTPS) report the same Apache httpd version (2.4.41), it strongly indicates that the same web server process is listening on both ports. Apache httpd can be configured to handle both plain HTTP and TLS-encrypted HTTPS traffic simultaneously, typically using separate VirtualHost directives or a single configuration that binds to both ports. The identical version string makes it unlikely that two separate web server instances are running, as they would often differ in patch level or configuration.

Answer

The target is running two separate web servers on different ports

Answer

The target is running a reverse proxy that forwards traffic to different backends

Answer

The version detection is incorrect due to false positives

Question 12

During a vulnerability assessment, which of the following tools is a comprehensive vulnerability scanner that uses a plugin architecture to detect thousands of vulnerabilities?

Accepted Answer

Nessus. Nessus is a comprehensive vulnerability scanner that uses a plugin-based architecture to detect thousands of vulnerabilities across a wide range of systems and services. Each plugin corresponds to a specific vulnerability check, and the Nessus engine executes them in sequence or in parallel against the target, making it highly extensible and up-to-date with the latest CVEs.

Answer

Wireshark

Answer

OpenVAS

Answer

Nmap

Question 13

Which TWO of the following are examples of active reconnaissance techniques? (Select two)

Accepted Answer

Running an Nmap SYN scan against a target. Option B is correct because an Nmap SYN scan (also known as a half-open scan) sends a TCP SYN packet to a target port and analyzes the response. If a SYN/ACK is received, the port is open; if an RST is received, the port is closed. This scan actively interacts with the target system by sending network traffic, making it an active reconnaissance technique.

Answer

Querying Shodan for open ports on a target

Answer

Searching for sensitive files using Google dorks

Answer

Performing a WHOIS lookup

Question 14

Which THREE of the following Nmap options can be used to evade detection by IDS/IPS? (Select three)

Accepted Answer

-f (fragment packets). Option B is correct because the -f flag fragments the crafted packets into smaller pieces, typically 8-byte fragments, which can bypass simple IDS/IPS signatures that expect full unfragmented packets. This technique exploits the fact that many intrusion detection systems struggle to reassemble fragmented packets in real time, allowing the scan to evade detection.

Answer

-sV (version detection)

Answer

-O (OS detection)

Question 15

A penetration tester is conducting DNS enumeration. Which TWO of the following tools are specifically designed for DNS enumeration? (Select two)

Accepted Answer

dnsrecon. dnsrecon is a dedicated DNS enumeration tool that performs multiple types of DNS queries (e.g., SRV, MX, SOA, zone transfer attempts) and supports brute-force subdomain discovery. It is specifically designed to gather DNS records and identify misconfigurations, making it a primary tool for DNS enumeration.

Answer

theHarvester

Answer

Nmap

Answer

Maltego