CEH Footprinting, Reconnaissance and Scanning — Timed 15 Questions

Question 1

A penetration tester is attempting to evade an IDS/IPS while performing a port scan. They use the Nmap command: nmap -sS -f --data-length 20 -D RND:10 10.0.0.1. Which techniques are being employed to evade detection?

15 minute time limit — choose an answer to begin.

Accepted Answer

Fragmentation, decoy, and using a random source IP. The explanation accurately identifies the three distinct evasion techniques from the Nmap command: fragmentation (-f), decoy scanning (-D RND:10), and packet data padding (--data-length 20). However, the explanation does not fully justify the marked correct option C, as option C fails to include 'packet data padding' and instead lists 'using a random source IP' which is either a consequence or rephrasing of the decoy technique, not a distinct third technique as identified by the command's flags.

Answer

Idle scan, fragmentation, and MAC address spoofing

Answer

Packet timing manipulation, decoy, and avoiding DNS resolution

Answer

Fragmentation, decoy, and source port spoofing

Question 2

Which THREE of the following are valid DNS record types that an attacker might query during reconnaissance to gather information about a target domain? (Select 3)

Accepted Answer

A (IPv4 address). The A record maps a domain name to an IPv4 address, which is fundamental for locating a target server. During reconnaissance, querying A records reveals the IP address of the target domain, enabling further scanning and attack planning. The NS (Name Server) record identifies the authoritative DNS servers for a domain, providing insight into the target's DNS infrastructure and potential points of attack or misconfiguration. The MX (Mail Exchange) record specifies the mail servers responsible for accepting email for a domain, which is crucial for identifying email infrastructure, potential phishing targets, or email server vulnerabilities. These are all standard DNS query types defined in RFC 1035 and are highly valuable for attackers during reconnaissance.

Answer

FTP (file transfer)

Answer

HTTP (hypertext transfer)

Question 3

A security analyst observes unusual outbound traffic from an internal host to an external IP on port 443. The analyst suspects a reverse shell where the internal host initiates an HTTPS connection to the attacker. Which Nmap script would be MOST useful to confirm the nature of this traffic if the analyst can run a scan on the internal host?

Accepted Answer

tls-nextprotoneg. tls-nextprotoneg is correct because it detects the TLS Next Protocol Negotiation (NPN) extension. Reverse shells often use NPN/ALPN to establish non-standard application-layer protocols over HTTPS to evade detection. If the analyst runs Nmap *from* the internal host *targeting the external IP*, this script can probe the external server to reveal if the TLS session it offers is attempting to negotiate a protocol other than standard HTTP, which would indicate a reverse shell command and control (C2) server.

Answer

smb-enum-shares

Answer

http-malware-host

Answer

ssh2-enum-algos

Question 4

A penetration tester runs `nmap -sS -sV -O -p- 192.168.1.10` and receives the following output snippet: 'PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4 80/tcp open http Apache httpd 2.4.6 443/tcp open ssl/http Apache httpd 2.4.6'. Which THREE pieces of information can the tester derive from this output? (Choose 3)

Accepted Answer

The -sV flag was used for version detection. The `-sV` flag in Nmap explicitly enables version detection, which probes open ports to determine the service and version information displayed in the output (e.g., 'OpenSSH 7.4', 'Apache httpd 2.4.6'). This directly supports option B. The output also explicitly states 'Apache httpd 2.4.6', confirming option C. However, the provided output snippet does not include any information about the target's operating system, making option E not derivable from the snippet.

Answer

The target has a vulnerability in OpenSSH 7.4

Answer

The target is vulnerable to the Heartbleed bug

Answer

The target is running a Linux-based operating system

Question 5

Which TWO of the following are valid port states that Nmap can report? (Select 2)

Accepted Answer

Open. Nmap reports 'Open' when a port responds to a probe (e.g., SYN, ACK, or connect scan) with a positive acknowledgment, indicating a service is actively listening. It reports 'Filtered' when packet filtering (e.g., a firewall) prevents Nmap's probes from reaching the port, making it impossible to determine if the port is open or closed. These are two of the six fundamental port states defined in Nmap's output, directly derived from TCP/IP protocol behavior during the scan.

Answer

Unknown

Answer

Secured

Answer

Blocked

Question 6

During a security assessment, a tester uses Netcat to connect to a target's SMTP port and receive the service banner. Which command would achieve this?

Accepted Answer

nc -v 25. The `nc 25` command establishes a TCP connection to the target's SMTP port. Upon connection, SMTP servers typically send a service banner (e.g., "220 smtp.example.com ESMTP"). Netcat, in client mode, prints all received data to standard output, thus displaying the banner. The `-v` (verbose) flag adds additional connection details and status messages, which can be helpful for a security assessment, but the banner itself would be displayed even without `-v`. Among the given options, D is the most appropriate choice as the other options are incorrect for the stated goal.

Answer

nc -z <target> 25

Answer

nc -l -p 25

Answer

nc -u <target> 25

Question 7

A penetration tester is conducting reconnaissance and wants to identify live hosts in a range without being detected. Which TWO techniques would be MOST appropriate? (Choose two.)

Accepted Answer

DNS query for reverse lookup. A DNS query for reverse lookup (PTR record) is a passive reconnaissance technique that queries DNS servers for hostnames associated with IP addresses. It does not send packets directly to the target hosts, making it difficult for intrusion detection systems (IDS) or firewalls to detect the probing activity. Passive OS fingerprinting involves analyzing existing network traffic (e.g., sniffing packets) to infer information about live hosts and their operating systems without sending any new probes or packets to the target. Both techniques allow a penetration tester to gather information about live hosts without generating network traffic that would alert defensive measures on the target network.

Answer

Ping sweep

Answer

ARP scan

Answer

TCP SYN scan

Question 8

A security analyst wants to perform banner grabbing on a web server without establishing a full TCP connection. Which tool would be MOST appropriate?

Accepted Answer

Wireshark. Wireshark is the only tool listed that can perform banner grabbing without establishing a full TCP connection because it operates passively by capturing network traffic. It can capture banners transmitted during existing sessions. Telnet, Nmap with -sT, and Netcat all require completing the TCP handshake to receive the banner, thus they do not meet the condition of 'without establishing a full TCP connection.'

Answer

Telnet

Answer

Nmap with -sT

Answer

Netcat

Question 9

Which THREE of the following are common countermeasures to prevent DNS zone transfers from being abused? (Choose THREE.)

Accepted Answer

Restrict zone transfers to only specific authorized secondary name servers. Restricting zone transfers to only specific authorized secondary name servers (Option B) is a fundamental access control measure that prevents unauthorized hosts from requesting a full copy of the DNS zone data, thereby mitigating information leakage during reconnaissance. Implementing split DNS (Option C) limits the information an external attacker can gain from a successful zone transfer by presenting different views of DNS data to internal and and external clients. Using Transaction Signatures (TSIG) (Option D) provides cryptographic authentication for zone transfer requests, ensuring that only trusted secondary servers with the shared secret key can perform transfers.

Answer

Enable DNS recursion on the name server

Answer

Configure the name server to allow zone transfers from any host

Question 10

Which THREE of the following are valid Nmap NSE scripts that could be used for service version detection or vulnerability scanning? (Choose THREE.)

Accepted Answer

ssl-heartbleed. The `ssl-heartbleed` NSE script (ssl-heartbleed.nse) specifically checks for the Heartbleed vulnerability (CVE-2014-0160) in OpenSSL implementations, making it a direct vulnerability scanning script. The `banner` script connects to a port and retrieves the service banner, which often contains service name and version information, thus serving for service version detection. The `http-sql-injection` script attempts to detect SQL injection vulnerabilities in HTTP services, making it a vulnerability scanning script. All three directly align with the question's criteria of service version detection or vulnerability scanning.

Answer

dns-zone-transfer

Answer

smb-os-discovery

Question 11

Which TWO of the following are examples of passive OS fingerprinting techniques? (Select 2)

Accepted Answer

Analyzing the initial TTL value of received IP packets. Passive OS fingerprinting involves observing network traffic without sending any packets to the target. Analyzing the initial TTL value of received IP packets (Option B) is a classic passive technique: different operating systems set specific default TTL values (e.g., Windows uses 128, Linux uses 64, Cisco IOS uses 255), allowing an attacker to infer the OS without direct interaction. Similarly, inspecting the TCP window size in SYN packets (Option D) is also a passive technique. Different operating systems advertise different default TCP window sizes when establishing connections, which can be observed by sniffing existing traffic without sending any new packets to the target. Options A, C, and E involve sending packets to the target, making them active fingerprinting techniques.

Answer

Performing a SYN scan on the target

Answer

Sending a series of TCP packets with different flags and analyzing responses

Answer

Using the telnet command to connect to port 80

Question 12

Which TWO of the following are common OSINT tools for passive reconnaissance? (Select 2)

Accepted Answer

theHarvester. theHarvester is a passive OSINT tool that gathers email addresses, subdomains, IPs, and virtual hosts from public sources like search engines (Google, Bing), PGP key servers, and the SHODAN database without sending any packets directly to the target. Maltego is also a passive OSINT tool that uses graphical link analysis to gather and connect information from various public sources (e.g., DNS records, social media, public databases) to map relationships between entities. Both tools align with passive reconnaissance, which relies on publicly available information rather than active probing.

Answer

Metasploit

Answer

hping3

Answer

Nmap

Question 13

Which THREE of the following are valid methods to prevent DNS zone transfer attacks? (Select 3)

Accepted Answer

Use TSIG (Transaction Signatures) for authentication. The explanation for option B is incorrect. Disabling recursive queries prevents a DNS server from performing lookups on behalf of external clients (preventing amplification attacks and general information leakage via recursion), but it does not prevent an authoritative server from responding to direct queries for its own zone or from performing zone transfers if configured to allow them. Zone transfers (AXFR/IXFR) are not recursive queries and are handled separately. Therefore, disabling recursion does not directly prevent or limit zone transfer attacks.

Answer

Increase the SOA refresh interval

Answer

Disable recursive queries for external hosts

Answer

Block all inbound traffic on UDP port 53

Question 14

Which THREE of the following are legitimate uses of the Shodan search engine in a security assessment? (Select 3)

Accepted Answer

Discovering internet-connected industrial control systems (ICS) with default passwords. Shodan is a search engine for internet-connected devices. It indexes banners from services like HTTP, SSH, and FTP, allowing security assessors to identify exposed industrial control systems (ICS) such as SCADA devices, and often revealing default configurations or weak security (Option B). Its ability to collect certificate information also allows for mapping SSL/TLS certificates to discover associated domains and subdomains (Option C). Fundamentally, Shodan's core function is to passively scan the internet and identify open ports and services on hosts within specified ranges, making it a powerful reconnaissance tool for understanding an organization's internet-facing attack surface (Option E). These are all legitimate reconnaissance uses in a security assessment, focusing on information gathering rather than active exploitation or social engineering.

Answer

Performing SQL injection on a web application

Answer

Sending phishing emails to employees of a target organization

Question 15

Which TWO OSINT tools are commonly used to gather email addresses and subdomains associated with a target domain? (Select 2)

Accepted Answer

theHarvester. theHarvester is a dedicated OSINT tool designed to gather email addresses, subdomains, IPs, and virtual hosts from public sources such as search engines (Google, Bing), PGP key servers, and the SHODAN database. It directly queries these sources to enumerate email addresses and subdomains associated with a target domain, making it a primary choice for passive reconnaissance. Maltego is a powerful graphical link analysis tool used for gathering and visualizing information from various sources, including email addresses and subdomains, by transforming data into entities and relationships. It can integrate with many data sources (transforms) to find connections and enumerate information related to a target domain.

Answer

Nmap

Answer

Nessus

Answer

Shodan