CEH Scanning Networks and Enumeration — 10 Questions

Question 1

During a penetration test, you discover that an internal web server responds to ICMP echo requests but does not respond to TCP SYN scans on port 80. However, when you browse to the server's IP using a browser, the web page loads successfully. What is the most likely reason for this behavior?

Accepted Answer

A stateful firewall is blocking inbound SYN packets to port 80 but allowing responses to outbound connections.. A stateful firewall tracks the state of network connections. When you browse to the server, your browser initiates an outbound TCP connection, and the firewall allows the return SYN-ACK packets as part of the established session. However, a standalone TCP SYN scan sends unsolicited SYN packets to port 80, which the firewall sees as a new inbound connection attempt and blocks, preventing the server from responding. The server's ICMP echo reply is allowed because ICMP is stateless and not typically filtered by the same rules.

Answer

The web server is running on a non-standard port that you did not scan.

Answer

The server's TCP/IP stack is misconfigured and does not respond to SYN scans.

Answer

A web application firewall is blocking the SYN scan traffic.

Question 2

A security analyst is using Nmap to scan a network segment 192.168.1.0/24 and wants to identify live hosts without sending packets to every IP. Which scan type should the analyst use to minimize network traffic while discovering active hosts?

Accepted Answer

Ping sweep using `nmap -sn`. Option C is correct because `nmap -sn` (ping sweep) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default, allowing the analyst to discover live hosts without scanning every port or sending packets to every IP individually. This minimizes network traffic compared to full port scans while still efficiently identifying active devices on the 192.168.1.0/24 subnet.

Answer

TCP SYN scan using `nmap -sS`

Answer

ARP scan using `nmap -PR`

Answer

UDP scan using `nmap -sU`

Question 3

During an internal penetration test, you are tasked with enumerating services on a target server. You run a full TCP port scan and find that ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) are open. You then perform version detection on these ports. Which additional enumeration step would provide the most valuable information for identifying potential vulnerabilities?

Accepted Answer

Perform banner grabbing on port 22 to identify the SSH version.. Banner grabbing on port 22 (SSH) is the most valuable next step because it directly identifies the SSH server version (e.g., OpenSSH 7.4). Knowing the exact version allows you to cross-reference known vulnerabilities (CVEs) for that specific SSH implementation, which is a common high-risk attack vector during internal penetration tests. While version detection already identified the service, banner grabbing can reveal additional details like patch levels or configuration quirks that version detection might miss.

Answer

Perform SNMP enumeration to gather system information.

Answer

Attempt a DNS zone transfer from the server.

Answer

Enumerate NetBIOS names using `nbtstat`.

Question 4

A network administrator needs to identify all devices on a large corporate network that are running a specific vulnerable version of OpenSSH. The administrator has network access and can use scanning tools. However, scanning the entire network might disrupt operations. Which approach minimizes disruption while accurately identifying the vulnerable hosts?

Accepted Answer

Run a TCP SYN scan on port 22 only, with version detection enabled, across the target IP range.. Option B is correct because it targets only TCP port 22 (the default SSH port) with a SYN scan, which is stealthier and faster than a full connect scan, and enables version detection to identify the specific vulnerable OpenSSH version. This minimizes disruption by avoiding scanning unnecessary ports and reduces network load, while accurately pinpointing vulnerable hosts.

Answer

Conduct a full TCP port scan of the entire network using SYN scan.

Answer

Use a ping sweep to identify live hosts, then perform a version scan on each.

Answer

Perform an ARP scan of the entire subnet and then check each host manually.

Question 5

You are conducting a security assessment and need to map the network topology and identify routers, firewalls, and other network devices. Which technique is specifically designed to discover the path packets take to reach a destination and can reveal intermediate devices?

Accepted Answer

Traceroute. Traceroute is the correct technique because it is specifically designed to map the path packets take from a source to a destination by manipulating the Time-to-Live (TTL) field in IP headers. As each hop decrements the TTL, routers along the path send ICMP Time Exceeded messages (or UDP responses in some implementations), revealing their IP addresses and thus identifying intermediate devices like routers and firewalls.

Answer

Banner grabbing

Answer

DNS enumeration

Answer

SNMP walk

Question 6

Which TWO types of information can be obtained through SNMP enumeration on a target device if the community string is 'public'? (Choose two.)

Accepted Answer

List of running processes. SNMP enumeration with the default 'public' community string (read-only access) allows querying MIB objects that expose system information. The 'hostResources' MIB (RFC 2790) includes the 'hrSWRunTable', which lists running processes, and the 'ipRouteTable' (RFC 1213) provides routing table entries. These are standard read-only OIDs accessible without authentication.

Answer

Captured network packets

Answer

User account passwords

Answer

Modify network interface settings

Question 7

Which THREE Nmap options are commonly used to evade firewall detection during a scan? (Choose three.)

Accepted Answer

-f (fragment packets). Option A is correct because the -f flag fragments the IP packets into smaller pieces (typically 8-byte fragments) to bypass simple packet-filtering firewalls and intrusion detection systems that do not reassemble fragmented packets before applying filtering rules. This technique exploits the fact that many stateless firewalls only inspect the first fragment and allow subsequent fragments through unchecked, enabling the scan to reach the target.

Answer

-sT (TCP connect scan)

Answer

-sV (version detection)

Question 8

Refer to the exhibit. An Nmap scan shows that port 80 is 'filtered' while ports 22 and 443 are 'open'. What does the 'filtered' state indicate?

Accepted Answer

A firewall, router rule, or host-based firewall is blocking the probes.. When Nmap reports a port as 'filtered', it means that the scan probes (e.g., SYN packets) were dropped or blocked before reaching the target service, typically by a firewall, router ACL, or host-based firewall. Unlike 'open' (which receives a SYN/ACK) or 'closed' (which receives a RST), 'filtered' indicates no response or an ICMP unreachable message, so Nmap cannot confirm whether the port is actually open or closed.

Answer

The port is closed and the target sent a RST packet.

Answer

The port is open but the service is not responding to the scan.

Answer

The port is open but Nmap cannot determine the service.

Question 9

You are a penetration tester assessing a client's internal network. The client has provided you with a non-administrative domain user account. The target network consists of 200 Windows workstations and 5 Windows servers (one domain controller, one file server, two application servers, and one database server). All systems are fully patched and have host-based firewalls enabled. The client wants you to identify vulnerabilities that could be exploited from the internal network. After initial reconnaissance, you discover that all servers have SMB (port 445) open only to the domain controller and the file server has SMB open to all workstations. You have gained a foothold on a workstation via a phishing attack. From this workstation, you can reach the file server on port 445. What is the most effective next step to enumerate potential vulnerabilities on the file server?

Accepted Answer

Enumerate SMB shares and session information using `net view \fileserver` and `smbclient -L //fileserver`.. Option D is correct because the client's objective is to enumerate potential vulnerabilities on the file server from the compromised workstation. Since SMB (port 445) is open between workstations and the file server, using `net view \fileserver` and `smbclient -L //fileserver` allows you to list SMB shares, sessions, and other information without requiring administrative privileges or additional tools. This is a standard enumeration technique that reveals accessible resources, which can then be tested for misconfigurations or weak permissions.

Answer

Attempt to connect to the file server via RDP (port 3389) using the compromised user's credentials.

Answer

Use PsExec to execute commands remotely on the file server using the compromised user account.

Answer

Run a full vulnerability scan (e.g., Nessus) against the entire subnet to identify weaknesses.

Question 10

A penetration tester discovers that an Nmap SYN scan against a target host returns no open ports, but a TCP connect scan reveals port 443 open. Which of the following is the most likely reason for this discrepancy?

Accepted Answer

A network firewall is performing stateful inspection and dropping unsolicited SYN packets while allowing established connections.. The discrepancy occurs because a network firewall is performing stateful inspection. It drops unsolicited SYN packets (the first step of a SYN scan) but allows full TCP connections (SYN, SYN-ACK, ACK) to complete, as the connect scan establishes a full three-way handshake. This behavior is typical of stateful firewalls that track connection state and only permit packets belonging to established sessions.

Answer

The target host has a host-based firewall that drops SYN packets but allows full connections.

Answer

The target host has ICMP filtering enabled, preventing Nmap from identifying it as online.

Answer

Nmap's SYN scan requires root privileges, and the tester ran it without sudo.