CEH Footprinting, Reconnaissance and Scanning Practice Test 9 — 15 Questions

Question 1

Which of the following tools is specifically designed for high-speed port scanning across large address spaces?

Accepted Answer

Masscan. Masscan is specifically designed for high-speed port scanning across large address spaces, capable of transmitting packets at rates exceeding 10 million packets per second. It achieves this by using asynchronous transmission and a custom TCP/IP stack, making it ideal for scanning the entire IPv4 internet or massive subnets in minutes, unlike general-purpose scanners that prioritize accuracy over raw speed.

Answer

Zenmap

Answer

hping3

Answer

Nmap

Question 2

A penetration tester wants to evade an IDS while scanning a target network. The tester uses the Nmap command: nmap -sS -f 10.10.10.1. What does the -f flag accomplish?

Accepted Answer

It fragments the IP packets into 8-byte fragments. The -f flag in Nmap instructs the tool to fragment the IP packets into 8-byte fragments (or smaller, depending on the MTU). This is a common evasion technique used to bypass Intrusion Detection Systems (IDS) and firewalls by splitting the TCP header across multiple packets, making it harder for signature-based detection to reassemble and match the scan pattern.

Answer

It increases the timing template to T5 (insane)

Answer

It uses an idle scan by bouncing off a zombie host

Answer

It sends packets with a spoofed source IP address

Question 3

A security analyst observes the following Nmap output for a target host: PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https. The analyst then runs a version detection scan and notices that port 80 reports 'Apache httpd 2.4.41' but port 443 reports 'Apache httpd 2.4.41' as well. What is the MOST likely conclusion?

Accepted Answer

The target is likely running a single web server that handles both HTTP and HTTPS traffic. When both port 80 (HTTP) and port 443 (HTTPS) report the same Apache httpd version (2.4.41), it strongly indicates that the same web server process is listening on both ports. Apache httpd can be configured to handle both plain HTTP and TLS-encrypted HTTPS traffic simultaneously, typically using separate VirtualHost directives or a single configuration that binds to both ports. The identical version string makes it unlikely that two separate web server instances are running, as they would often differ in patch level or configuration.

Answer

The target is running two separate web servers on different ports

Answer

The target is running a reverse proxy that forwards traffic to different backends

Answer

The version detection is incorrect due to false positives

Question 4

During a vulnerability assessment, which of the following tools is a comprehensive vulnerability scanner that uses a plugin architecture to detect thousands of vulnerabilities?

Accepted Answer

Nessus. Nessus is a comprehensive vulnerability scanner that uses a plugin-based architecture to detect thousands of vulnerabilities across a wide range of systems and services. Each plugin corresponds to a specific vulnerability check, and the Nessus engine executes them in sequence or in parallel against the target, making it highly extensible and up-to-date with the latest CVEs.

Answer

Wireshark

Answer

OpenVAS

Answer

Nmap

Question 5

Which TWO of the following are examples of active reconnaissance techniques? (Select two)

Accepted Answer

Running an Nmap SYN scan against a target. An Nmap SYN scan (also known as a half-open scan) sends a TCP SYN packet to a target port and analyzes the response. If a SYN/ACK is received, the port is open; if an RST is received, the port is closed. This scan actively interacts with the target system by sending network traffic, making it an active reconnaissance technique.

Answer

Querying Shodan for open ports on a target

Answer

Searching for sensitive files using Google dorks

Answer

Performing a WHOIS lookup

Question 6

Which THREE of the following Nmap options can be used to evade detection by IDS/IPS? (Select three)

Accepted Answer

-f (fragment packets). The -f flag fragments the crafted packets into smaller pieces, typically 8-byte fragments, which can bypass simple IDS/IPS signatures that expect full unfragmented packets. This technique exploits the fact that many intrusion detection systems struggle to reassemble fragmented packets in real time, allowing the scan to evade detection.

Answer

-sV (version detection)

Answer

-O (OS detection)

Question 7

A penetration tester is conducting DNS enumeration. Which TWO of the following tools are specifically designed for DNS enumeration? (Select two)

Accepted Answer

dnsrecon. dnsrecon is a dedicated DNS enumeration tool that performs multiple types of DNS queries (e.g., SRV, MX, SOA, zone transfer attempts) and supports brute-force subdomain discovery. It is specifically designed to gather DNS records and identify misconfigurations, making it a primary tool for DNS enumeration.

Answer

theHarvester

Answer

Nmap

Answer

Maltego

Question 8

Which of the following tools is PRIMARILY used for passive OSINT gathering and can query multiple search engines, social media platforms, and public databases to collect information about a target?

Accepted Answer

Maltego. Maltego is primarily used for passive OSINT gathering because it leverages open-source intelligence feeds, search engines, social media platforms, and public databases to collect and correlate information about a target without directly interacting with the target's systems. Its transform-based architecture allows it to query multiple data sources simultaneously, making it the correct choice for passive reconnaissance.

Answer

Nmap

Answer

Wireshark

Answer

theHarvester

Question 9

A security analyst runs `nmap -sU -p 161,162 10.0.0.1` and receives output showing port 161/udp is open. Which service is MOST likely running on this port?

Accepted Answer

SNMP. Port 161/udp is the default port for SNMP (Simple Network Management Protocol) used by SNMP agents to receive management queries (GET, SET) from SNMP managers. The `-sU` flag performs a UDP scan, and the open result on 161/udp strongly indicates an SNMP service is listening, as defined in RFC 1157.

Answer

DHCP

Answer

TFTP

Answer

DNS

Question 10

During a penetration test, you execute a DNS zone transfer request against a target domain and succeed. Which type of DNS record would you expect to reveal the mail servers for the domain?

Accepted Answer

MX record. An MX (Mail Exchange) record is the DNS record type that specifies the mail servers responsible for accepting email messages on behalf of a domain. During a successful DNS zone transfer, the full zone file is retrieved, and MX records are included, directly revealing the domain's mail server hostnames and priority values.

Answer

CNAME record

Answer

A record

Answer

NS record

Question 11

Which TWO techniques are considered active reconnaissance? (Choose TWO.)

Accepted Answer

Port scanning with Nmap. Port scanning with Nmap (Option C) is active reconnaissance because it sends crafted packets (e.g., TCP SYN, UDP probes) directly to target systems and analyzes the responses to determine open ports, running services, and operating system details. Banner grabbing with Netcat (Option D) is also active reconnaissance as it establishes a TCP connection to a target service (e.g., HTTP, FTP) and reads the service banner, which involves direct interaction with the target. Both techniques generate detectable network traffic and can be logged by intrusion detection systems.

Answer

Using Google dorking to find exposed files

Answer

Querying Shodan for exposed devices

Answer

Performing a WHOIS lookup

Question 12

A penetration tester wants to perform a stealthy TCP scan that does not complete the three-way handshake. Which Nmap flag should be used?

Accepted Answer

-sS. (-sS) is correct because it performs a SYN scan, which sends a TCP SYN packet and waits for a SYN-ACK response without completing the three-way handshake (i.e., it sends a RST instead of an ACK). This makes the scan stealthy as it avoids establishing a full TCP connection, reducing the chance of being logged by the target.

Answer

-sU

Answer

-sV

Answer

-sT

Question 13

You are investigating a suspected data exfiltration. Network logs show an internal host performing numerous DNS queries to a domain that does not exist in any organization records. The queries use various subdomains. Which technique is the attacker MOST likely using?

Accepted Answer

DNS tunneling. The attacker is most likely using DNS tunneling, which encodes data from exfiltrated information into DNS queries and responses. By making numerous DNS queries to a domain they control, with data encoded in the subdomain labels, the attacker can bypass network security controls that do not inspect DNS traffic deeply. The fact that the domain does not exist in organization records and uses various subdomains is a classic indicator of DNS tunneling.

Answer

DNS amplification attack

Answer

DNS cache poisoning

Answer

DNS zone transfer

Question 14

A security team observes repeated Nmap scans from an external IP address. The scans show fragmented IP packets. Which evasion technique is the attacker using?

Accepted Answer

Fragmentation. The attacker is using fragmentation to evade detection by splitting the Nmap probe packets into smaller fragments. This technique bypasses simple packet filters and intrusion detection systems (IDS) that lack IP fragment reassembly capabilities, as the fragments are typically allowed through individually. Nmap's `-f` flag or `--mtu` option is used to send fragmented IP packets, making the scan less conspicuous.

Answer

Decoy scan

Answer

ACK scan

Answer

Idle scan

Question 15

Which of the following is an example of passive OS fingerprinting?

Accepted Answer

Analyzing TTL values from captured packets. Passive OS fingerprinting involves analyzing captured network traffic without sending any packets to the target. Examining TTL (Time to Live) values from captured packets is a classic passive technique because different operating systems use default initial TTL values (e.g., Windows uses 128, Linux uses 64, Cisco IOS uses 255), and by observing the TTL in a received packet, you can infer the OS without actively probing the host.

Answer

Performing a TCP SYN scan

Answer

Nmap -O scan

Answer

Sending ICMP echo requests