CEH Footprinting, Reconnaissance and Scanning Practice Test 8 — 15 Questions

Question 1

Which of the following is a passive OS fingerprinting technique that does NOT send any packets to the target?

Accepted Answer

Analyzing TTL and window size from captured packets. Passive OS fingerprinting involves observing network traffic without sending any packets to the target. Analyzing the Time-to-Live (TTL) and TCP window size from captured packets is a classic passive technique because these values are OS-specific defaults (e.g., Linux often uses TTL 64 and window size 5840, while Windows uses TTL 128 and window size 65535). Since no packets are sent to the target, this method is entirely passive and undetectable.

Answer

Sending TCP SYN packets and analyzing responses

Answer

Performing a NULL scan

Answer

Using Nmap -O flag

Question 2

During a vulnerability scan using Nessus, a security analyst discovers that the target host shows a 'High' severity vulnerability for 'SSL/TLS Renegotiation DoS'. What does this vulnerability indicate?

Accepted Answer

An attacker can force the server to renegotiate TLS handshakes repeatedly, causing resource exhaustion. The SSL/TLS Renegotiation DoS vulnerability (CVE-2011-1473) occurs when a server supports TLS renegotiation without proper rate limiting. An attacker can open multiple connections and repeatedly request renegotiation, causing the server to consume excessive CPU resources for cryptographic handshake calculations, effectively leading to a denial of service. Nessus flags this as 'High' severity because it can exhaust server resources even with a single attacker.

Answer

The server does not validate SSL certificates

Answer

The server supports SSLv2

Answer

The server allows weak cipher suites

Question 3

Which of the following Nmap flags would an attacker use to evade IDS by sending fragmented IP packets?

Accepted Answer

-f. The -f flag in Nmap instructs the tool to fragment the transmitted packets into smaller pieces (typically 8-byte fragments). This fragmentation is used to evade Intrusion Detection Systems (IDS) that rely on signature matching against complete, unfragmented packets, as the IDS may not reassemble the fragments before inspection or may fail to detect the malicious payload when spread across multiple fragments.

Answer

-D

Answer

-g

Answer

-sS

Question 4

A penetration tester uses theHarvester to gather information about a target domain. Which of the following data types is theHarvester PRIMARILY designed to collect?

Accepted Answer

Email addresses and subdomains. theHarvester is an open-source intelligence (OSINT) tool designed to perform passive reconnaissance by querying public sources such as search engines (Google, Bing), PGP key servers, and the Shodan API. Its primary function is to collect email addresses, subdomains, IP addresses, and virtual hosts associated with a target domain, aiding in the footprinting phase of a penetration test.

Answer

Live network traffic captures

Answer

Passwords hashes

Answer

Vulnerability scan results

Question 5

Which TWO of the following techniques are considered passive reconnaissance? (Select exactly 2.)

Accepted Answer

Performing a WHOIS lookup. A WHOIS lookup queries public databases (e.g., whois.arin.net) to retrieve registration details for domains or IP blocks. This process does not send any packets directly to the target system; it relies on third-party servers, making it a passive reconnaissance technique.

Answer

Connecting to a web server to grab its banner

Answer

Sending ICMP echo requests to a target

Answer

Running a Nmap SYN scan

Question 6

Which THREE of the following are valid Nmap flags that can be used to evade detection by an IDS? (Select exactly 3.)

Accepted Answer

-D. (-D) is correct because the decoy scan flag allows you to spoof multiple source IP addresses, making it difficult for an IDS to distinguish the real scanning host from the decoys. This technique floods the target with scan traffic from many IPs, obscuring the true origin and evading detection.

Answer

-O

Answer

-sS

Question 7

A penetration tester wants to perform DNS zone transfer enumeration. Which TWO of the following tools can be used for this purpose? (Select exactly 2.)

Accepted Answer

dnsrecon. Dnsrecon is a dedicated DNS enumeration tool that supports zone transfer requests (AXFR queries) to retrieve all DNS records from a nameserver if it is misconfigured to allow transfers from any host. It can also perform other DNS reconnaissance tasks such as SRV record enumeration and subdomain brute-forcing, making it a direct choice for zone transfer enumeration.

Answer

Shodan

Answer

Maltego

Answer

theHarvester

Question 8

A security analyst performs a passive reconnaissance of a target domain using public resources. Which of the following techniques would be considered passive reconnaissance?

Accepted Answer

Performing a WHOIS lookup for the target domain. Passive reconnaissance involves gathering information without directly interacting with the target's systems, thus avoiding any network traffic that could be detected. A WHOIS lookup queries a public registry database (e.g., whois.arin.net) over port 43 or via a web interface, retrieving domain registration details without sending any packets to the target's own infrastructure. This makes it a purely passive technique.

Answer

Using Netcat to grab banners from the target's email server

Answer

Running Nmap SYN scan on the target's web server

Answer

Sending a ping sweep to the target's public IP range

Question 9

During a penetration test, the tester wants to discover all subdomains of a target domain using an OSINT technique. Which tool is specifically designed for subdomain enumeration via search engines and public records?

Accepted Answer

theHarvester. theHarvester is specifically designed to perform OSINT-based subdomain enumeration by querying search engines (e.g., Google, Bing) and public data sources (e.g., PGP key servers, DNSDumpster). It collects email addresses, subdomains, IPs, and virtual hosts without direct interaction with the target's infrastructure, making it ideal for passive reconnaissance.

Answer

Maltego

Answer

Shodan

Answer

dnsrecon

Question 10

A security analyst notices a large number of incomplete TCP connections (SYN_RECV) on a server. Which Nmap scan type is the MOST likely cause of this symptom?

Accepted Answer

SYN scan (-sS). A SYN scan (-sS) sends a SYN packet to initiate a TCP handshake and, upon receiving a SYN/ACK, sends a RST to tear down the connection before it completes. This leaves the server with half-open connections in the SYN_RECV state because the three-way handshake is never finished. The large number of incomplete connections directly matches the behavior of a SYN scan.

Answer

Ping sweep (-sn)

Answer

TCP Connect scan (-sT)

Answer

UDP scan (-sU)

Question 11

A penetration tester uses the following Google dork: intitle:"index of" "backup" site:example.com. What is the MOST likely goal of this search?

Accepted Answer

Locate open directories that might contain sensitive files. The Google dork `intitle:"index of" "backup" site:example.com` targets web servers that have directory listing enabled (indicated by the page title containing 'index of') and that contain a folder or file named 'backup'. This is a classic reconnaissance technique to find open directories where backup files (e.g., database dumps, configuration files) may be inadvertently exposed, potentially containing sensitive data such as credentials or proprietary information.

Answer

Discover email addresses associated with the domain

Answer

Find login pages of the target domain

Answer

Identify subdomains of example.com

Question 12

An analyst runs the following command: dnsenum --enum example.com. Which of the following actions is dnsenum performing?

Accepted Answer

Attempts a zone transfer and brute-forces subdomains. The `dnsenum` tool is designed for DNS enumeration, and its `--enum` flag performs a comprehensive scan that includes attempting a zone transfer (AXFR query) to retrieve all DNS records from the nameserver, and if that fails, it brute-forces subdomains using a wordlist. This matches option A exactly.

Answer

Scans for open ports on the DNS server

Answer

Queries the DNS server for its version information

Answer

Performs a reverse DNS lookup to find PTR records for the IP range

Question 13

Which Nmap flag is used to perform a TCP SYN scan without completing the three-way handshake?

Accepted Answer

-sS. The -sS flag instructs Nmap to perform a TCP SYN scan, which sends a SYN packet to the target port and, upon receiving a SYN/ACK response, sends an RST packet instead of completing the three-way handshake with an ACK. This allows the scanner to determine port states without establishing a full TCP connection, making it faster and less detectable than a full connect scan.

Answer

-sT

Answer

-sU

Answer

-sA

Question 14

During a penetration test, the tester needs to identify the operating system of a remote host without sending any packets to it. Which technique should the tester use?

Accepted Answer

Passive OS fingerprinting using captured packets. Passive OS fingerprinting (Option B) is correct because it analyzes captured network traffic—such as TCP/IP packet headers, TTL values, window sizes, and DF flags—to infer the remote host's operating system without sending any packets. This technique relies on subtle differences in how various OS stacks implement RFC 793, making it ideal for stealthy reconnaissance where no direct contact with the target is permitted.

Answer

Banner grabbing with Telnet

Answer

Querying Shodan for the target IP

Answer

Active OS fingerprinting with Nmap -O

Question 15

A security analyst runs the command: nmap -sS -p 80,443,8080 --script http-headers scanme.nmap.org. The output shows that port 80 is filtered. What does 'filtered' mean in this context?

Accepted Answer

A firewall or IDS is preventing the probe from reaching the port. In Nmap, a 'filtered' port status indicates that the port is being blocked by a firewall, IDS, or other network filtering device, preventing the probe from reaching the target service. The -sS (SYN stealth scan) sends a SYN packet; if no response is received or an ICMP unreachable (type 3, code 13) is returned, Nmap marks the port as filtered. This does not mean the port is open or closed—it means the scan could not determine the state due to filtering.

Answer

The port is open, but the service is not responding

Answer

The port is open and actively listening

Answer

The port is closed, but the target is responding with RST packets