CEH Footprinting, Reconnaissance and Scanning Practice Test 9 — 15 Questions

Question 1

Which of the following tools is PRIMARILY used for passive OSINT gathering and can query multiple search engines, social media platforms, and public databases to collect information about a target?

Accepted Answer

Maltego. Maltego is primarily used for passive OSINT gathering because it leverages open-source intelligence feeds, search engines, social media platforms, and public databases to collect and correlate information about a target without directly interacting with the target's systems. Its transform-based architecture allows it to query multiple data sources simultaneously, making it the correct choice for passive reconnaissance.

Answer

Nmap

Answer

Wireshark

Answer

theHarvester

Question 2

A security analyst runs `nmap -sU -p 161,162 10.0.0.1` and receives output showing port 161/udp is open. Which service is MOST likely running on this port?

Accepted Answer

SNMP. Port 161/udp is the default port for SNMP (Simple Network Management Protocol) used by SNMP agents to receive management queries (GET, SET) from SNMP managers. The `-sU` flag performs a UDP scan, and the open result on 161/udp strongly indicates an SNMP service is listening, as defined in RFC 1157.

Answer

DHCP

Answer

TFTP

Answer

DNS

Question 3

During a penetration test, you execute a DNS zone transfer request against a target domain and succeed. Which type of DNS record would you expect to reveal the mail servers for the domain?

Accepted Answer

MX record. An MX (Mail Exchange) record is the DNS record type that specifies the mail servers responsible for accepting email messages on behalf of a domain. During a successful DNS zone transfer, the full zone file is retrieved, and MX records are included, directly revealing the domain's mail server hostnames and priority values.

Answer

CNAME record

Answer

A record

Answer

NS record

Question 4

Which TWO techniques are considered active reconnaissance? (Choose TWO.)

Accepted Answer

Port scanning with Nmap. Port scanning with Nmap (Option C) is active reconnaissance because it sends crafted packets (e.g., TCP SYN, UDP probes) directly to target systems and analyzes the responses to determine open ports, running services, and operating system details. Banner grabbing with Netcat (Option D) is also active reconnaissance as it establishes a TCP connection to a target service (e.g., HTTP, FTP) and reads the service banner, which involves direct interaction with the target. Both techniques generate detectable network traffic and can be logged by intrusion detection systems.

Answer

Using Google dorking to find exposed files

Answer

Querying Shodan for exposed devices

Answer

Performing a WHOIS lookup

Question 5

A penetration tester wants to perform a stealthy TCP scan that does not complete the three-way handshake. Which Nmap flag should be used?

Accepted Answer

-sS. Option B (-sS) is correct because it performs a SYN scan, which sends a TCP SYN packet and waits for a SYN-ACK response without completing the three-way handshake (i.e., it sends a RST instead of an ACK). This makes the scan stealthy as it avoids establishing a full TCP connection, reducing the chance of being logged by the target.

Answer

-sU

Answer

-sV

Answer

-sT

Question 6

You are investigating a suspected data exfiltration. Network logs show an internal host performing numerous DNS queries to a domain that does not exist in any organization records. The queries use various subdomains. Which technique is the attacker MOST likely using?

Accepted Answer

DNS tunneling. The attacker is most likely using DNS tunneling, which encodes data from exfiltrated information into DNS queries and responses. By making numerous DNS queries to a domain they control, with data encoded in the subdomain labels, the attacker can bypass network security controls that do not inspect DNS traffic deeply. The fact that the domain does not exist in organization records and uses various subdomains is a classic indicator of DNS tunneling.

Answer

DNS amplification attack

Answer

DNS cache poisoning

Answer

DNS zone transfer

Question 7

Which THREE of the following are common countermeasures to prevent DNS zone transfers from being abused? (Choose THREE.)

Accepted Answer

Restrict zone transfers to only specific authorized secondary name servers. Option B is correct because restricting zone transfers to only specific authorized secondary name servers prevents unauthorized hosts from requesting a full copy of the DNS zone data. This is a fundamental access control measure that limits the AXFR query to trusted IP addresses, thereby mitigating information leakage during reconnaissance.

Answer

Enable DNS recursion on the name server

Answer

Configure the name server to allow zone transfers from any host

Question 8

A security team observes repeated Nmap scans from an external IP address. The scans show fragmented IP packets. Which evasion technique is the attacker using?

Accepted Answer

Fragmentation. The attacker is using fragmentation to evade detection by splitting the Nmap probe packets into smaller fragments. This technique bypasses simple packet filters and intrusion detection systems (IDS) that lack IP fragment reassembly capabilities, as the fragments are typically allowed through individually. Nmap's `-f` flag or `--mtu` option is used to send fragmented IP packets, making the scan less conspicuous.

Answer

Decoy scan

Answer

ACK scan

Answer

Idle scan

Question 9

Which of the following is an example of passive OS fingerprinting?

Accepted Answer

Analyzing TTL values from captured packets. Passive OS fingerprinting involves analyzing captured network traffic without sending any packets to the target. Examining TTL (Time to Live) values from captured packets is a classic passive technique because different operating systems use default initial TTL values (e.g., Windows uses 128, Linux uses 64, Cisco IOS uses 255), and by observing the TTL in a received packet, you can infer the OS without actively probing the host.

Answer

Performing a TCP SYN scan

Answer

Nmap -O scan

Answer

Sending ICMP echo requests

Question 10

During a vulnerability scan with Nessus, you find that port 445/TCP is open on a Windows server. Which of the following is the MOST likely associated risk?

Accepted Answer

Remote code execution via SMB vulnerabilities. Port 445/TCP is used by Microsoft SMB (Server Message Block) over a direct TCP connection, commonly known as SMB over TCP. SMB has historically been plagued by critical remote code execution vulnerabilities, most notably EternalBlue (MS17-010) exploited by WannaCry. Therefore, an open SMB port on a Windows server presents a high risk of remote code execution if unpatched.

Answer

SNMP community string brute-forcing

Answer

HTTP directory traversal

Answer

DNS cache poisoning

Question 11

A security analyst issues the command `dnsenum example.com` and receives a list of subdomains, mail servers, and name servers. What information is revealed by the presence of multiple MX records?

Accepted Answer

The domain uses multiple mail servers for load balancing and failover. Multiple MX records in a DNS zone file indicate that the domain is configured with more than one mail exchange server. This setup provides redundancy and load balancing for email delivery, as defined in RFC 5321. The `dnsenum` tool enumerates these records from the DNS server, revealing the domain's email infrastructure design.

Answer

The domain has been compromised

Answer

The domain uses a single mail server with multiple aliases

Answer

The domain is participating in a DDoS attack

Question 12

Which TWO of the following are considered passive reconnaissance techniques? (Choose TWO.)

Accepted Answer

WHOIS lookup. WHOIS lookup is a passive reconnaissance technique because it queries public domain registration databases (via WHOIS protocol, RFC 3912) to obtain information such as registrar, registrant contact details, name servers, and expiration dates. This process does not send any packets directly to the target's infrastructure; instead, it relies on third-party data sources, making it undetectable by the target.

Answer

Ping sweep

Answer

Banner grabbing with Telnet

Answer

Port scanning

Question 13

You need to perform a fast scan of all 65535 TCP ports on a target IP address. Which tool is specifically designed for high-speed scanning and can surpass Nmap's speed on large-scale networks?

Accepted Answer

Masscan. Masscan is the correct answer because it is specifically engineered for high-speed asynchronous scanning, capable of transmitting packets at rates exceeding 10 million packets per second, which allows it to scan all 65535 TCP ports on a target significantly faster than Nmap, even with the -T5 timing template. Unlike Nmap's synchronous or adaptive scanning, Masscan uses a custom TCP/IP stack and raw sockets to maximize throughput, making it the optimal tool for large-scale network reconnaissance.

Answer

Netcat

Answer

hping3

Answer

Nmap with -T5

Question 14

Which THREE of the following are valid Nmap NSE scripts that could be used for service version detection or vulnerability scanning? (Choose THREE.)

Accepted Answer

ssl-heartbleed. Option C is correct because the ssl-heartbleed NSE script (ssl-heartbleed.nse) specifically checks for the Heartbleed vulnerability (CVE-2014-0160) in OpenSSL implementations. It sends a malformed TLS heartbeat request and inspects the response for leaked memory contents, making it a direct vulnerability scanning script. This script is part of Nmap's NSE library and is widely used for identifying vulnerable SSL/TLS services.

Answer

dns-zone-transfer

Answer

smb-os-discovery

Question 15

A penetration tester runs `nmap -sI 192.168.1.10 -p 80 10.0.0.1` and receives output indicating port 80 is open. The scan uses a zombie host. Which type of scan is this?

Accepted Answer

Idle scan. The `-sI` flag in Nmap specifies an idle scan, which uses a zombie host (192.168.1.10) to probe the target (10.0.0.1). By observing changes in the zombie's IP ID sequence, the attacker can infer whether a port on the target is open or closed without revealing their own IP address. The output indicating port 80 is open confirms the scan type as an idle scan.

Answer

SYN scan

Answer

Decoy scan

Answer

Fragmentation scan