CEH Scanning Networks and Enumeration — Timed 15 Questions

Question 1

During a penetration test, you discover that an internal web server responds to ICMP echo requests but does not respond to TCP SYN scans on port 80. However, when you browse to the server's IP using a browser, the web page loads successfully. What is the most likely reason for this behavior?

15 minute time limit — choose an answer to begin.

Accepted Answer

A web application firewall is blocking the SYN scan traffic.. A Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) is designed to detect and block malicious traffic patterns, including port scanning attempts (e.g., rapid SYN packets, specific flags, or lack of subsequent application-layer data), while allowing legitimate browser traffic. These systems analyze traffic patterns and application-layer characteristics to differentiate between a scan and normal user activity. While a WAF primarily operates at Layer 7, many modern WAFs or integrated security solutions include Layer 3/4 capabilities or are deployed in conjunction with devices that can block at the TCP layer, thus explaining why a SYN scan would be blocked but a full browser connection would succeed.

Answer

A stateful firewall is blocking inbound SYN packets to port 80 but allowing responses to outbound connections.

Answer

The web server is running on a non-standard port that you did not scan.

Answer

The server's TCP/IP stack is misconfigured and does not respond to SYN scans.

Question 2

A security analyst is using Nmap to scan a network segment 192.168.1.0/24 and wants to identify live hosts without sending packets to every IP. Which scan type should the analyst use to minimize network traffic while discovering active hosts?

Accepted Answer

ARP scan using `nmap -PR`. An ARP scan (`nmap -PR`) is the most efficient and lowest-traffic method for host discovery on a local network segment like 192.168.1.0/24. It sends ARP requests to identify live hosts, generating significantly less network traffic compared to other host discovery methods like ping sweeps (`-sn`) or full port scans. The question specifically asks to 'minimize network traffic' on a local segment, for which ARP is optimal.

Answer

TCP SYN scan using `nmap -sS`

Answer

Ping sweep using `nmap -sn`

Answer

UDP scan using `nmap -sU`

Question 3

A penetration tester discovers that an Nmap SYN scan against a target host returns no open ports, but a TCP connect scan reveals port 443 open. Which of the following is the most likely reason for this discrepancy?

Accepted Answer

A network firewall is performing stateful inspection and dropping unsolicited SYN packets while allowing established connections.. The discrepancy occurs because a network firewall is performing stateful inspection. It drops unsolicited SYN packets (the first step of a SYN scan) but allows full TCP connections (SYN, SYN-ACK, ACK) to complete, as the connect scan establishes a full three-way handshake. This behavior is typical of stateful firewalls that track connection state and only permit packets belonging to established sessions.

Answer

The target host has a host-based firewall that drops SYN packets but allows full connections.

Answer

The target host has ICMP filtering enabled, preventing Nmap from identifying it as online.

Answer

Nmap's SYN scan requires root privileges, and the tester ran it without sudo.

Question 4

Which THREE of the following are valid methods for enumerating users on a Windows domain without prior credentials? (Select exactly 3.)

Accepted Answer

Performing an SMB null session and querying the SAM database.. SMB null sessions (connecting to IPC$ without credentials) can be used to query the SAM database via the SAMR protocol, allowing an attacker to enumerate local user accounts and groups on a Windows system. This technique exploits the default configuration of older Windows versions or improperly secured systems where the null session is not restricted. RID cycling (Option C) is often performed via SMB null sessions or authenticated SAMR connections to iterate through Relative Identifiers (RIDs) and discover valid user accounts. Anonymous LDAP queries (Option D) can enumerate users if the domain controller is misconfigured to allow anonymous binds and queries for user objects (objectClass=user).

Answer

Requesting a DNS zone transfer to obtain a list of user account names from the SRV records.

Answer

Sending Kerberos AS-REQ packets and analyzing the error codes (e.g., KDC_ERR_PREAUTH_REQUIRED vs KDC_ERR_C_PRINCIPAL_UNKNOWN).

Question 5

You are conducting a security assessment for a company that hosts a web application on AWS. The application consists of a public-facing load balancer, an EC2 instance running a Linux web server, and an RDS MySQL database in a private subnet. The web server is configured to allow SSH access only from the company's internal IP range (203.0.113.0/24). During initial reconnaissance, you discover that the load balancer's security group allows inbound HTTP/HTTPS from anywhere. You attempt an Nmap SYN scan against the EC2 instance's public IP but receive no response (host appears down). Using a TCP connect scan, you find that ports 80 and 443 are open on the EC2 instance's public IP, but port 22 is filtered. You then launch an EC2 instance in the same region and run a scan from that internal AWS IP, and you find that port 22 is open on the target EC2 instance's private IP. Which of the following is the most likely reason for the initial scan failure and the filtered SSH port?

Accepted Answer

The EC2 instance's security group only allows HTTP/HTTPS traffic from the load balancer's security group and SSH from the internal IP range. The load balancer's security group allows internet traffic to the load balancer, but the EC2 instance's security group does not allow direct internet traffic to the instance.. The EC2 instance's security group is configured to allow HTTP/HTTPS only from the load balancer's security group (not from the internet directly) and SSH only from the company's internal IP range (203.0.113.0/24). The initial Nmap SYN scan against the *application's public endpoint (the load balancer's IP)* failed because the load balancer is not configured to forward arbitrary traffic, and the EC2 instance's security group drops all inbound traffic not explicitly allowed, including SYN packets to port 22 from external IPs, making the host appear down. The TCP connect scan revealed ports 80 and 443 open because the load balancer forwards traffic to those ports on the instance, and the EC2's security group allows this traffic from the load balancer. However, the security group still blocks direct internet access to the instance's public IP for SSH, resulting in a filtered state. The internal scan from another EC2 instance in the same VPC succeeded because the security group allows SSH from the internal IP range, and the private IP is reachable within the VPC.

Answer

The EC2 instance is behind a NAT gateway that only allows outbound traffic. The load balancer is in a public subnet, but the instance is in a private subnet and cannot be reached from the internet directly.

Answer

The VPC's network ACL is blocking inbound SYN packets to the EC2 instance's public IP, while allowing established connections. The TCP connect scan sends ACK packets, which bypass the ACL.

Answer

The EC2 instance does not have a public IP assigned; the load balancer performs destination NAT. The initial scan targeted the load balancer's IP, not the instance's IP.

Question 6

Which TWO of the following Nmap scan types are typically used to evade firewalls and IDS systems by sending fragmented packets?

Accepted Answer

Fragment scan (-f). The Fragment scan (-f) is correct because it splits TCP headers into multiple small IP fragments, making it harder for firewalls and IDS systems to reassemble and inspect the full packet. This evasion technique exploits the fact that many filtering devices only check the first fragment and pass subsequent fragments without scrutiny, allowing the scan to bypass detection.

Answer

SYN scan (-sS)

Answer

ACK scan (-sA)

Answer

Idle scan (-sI)

Answer

Xmas scan (-sX)

Question 7

Match each cloud security concept to its description.

Accepted Answer

Identity and Access Management (IAM): A framework of policies and technologies ensuring appropriate access to cloud resources.. Correct matches: IAM (A) governs access, CASB (B) enforces security policies, DLP (C) prevents data leaks, SDN (D) separates network control and data planes. Common confusions include swapping IAM with CASB and DLP with SDN.

Answer

Identity and Access Management (IAM): An on-premises or cloud-based security policy enforcement point placed between cloud consumers and providers.

Answer

Data Loss Prevention (DLP): A networking approach that separates control and forwarding planes for dynamic configuration.

Question 8

A penetration tester has completed a scan of a target subnet and obtained the IP addresses of several live hosts, but the client also wants to know the NetBIOS names and the logged-on user accounts for the Windows machines. Which enumeration technique should the tester use to gather this information?

Accepted Answer

Use enum4linux or a similar tool to perform NetBIOS and SMB enumeration.. Enumeration of Windows hosts for NetBIOS names and logged-on users typically requires tools that interact with SMB, NetBIOS, and RPC services. enum4linux automates these queries and can return both NetBIOS name tables and user session details, which aligns with the client's objectives. Port scanning and DNS zone transfers do not extract the required user-level information.

Answer

Perform a DNS zone transfer to obtain hostnames and associated user records.

Answer

Run nbtscan against the target IP range to retrieve NetBIOS name tables.

Answer

Use Nmap with the -sU -p 137,139,445 flags to scan for open NetBIOS ports.

Question 9

A penetration tester is performing an SMB enumeration against a Windows server and wants to list shared folders and their permissions. Which command-line tool is specifically designed for this purpose?

Accepted Answer

enum4linux. enum4linux is specifically built for enumerating SMB shares, users, groups, and permissions on Windows and Samba systems. Its -S option lists shares and their access rights, which is exactly what the tester needs. While other tools like smbclient or Nmap scripts can list shares, enum4linux provides the most comprehensive and straightforward output for this scenario.

Answer

net view

Answer

smbclient

Answer

nmap with smb-enum-shares script

Question 10

During an internal penetration test, you are tasked with enumerating services on a target server. You run a full TCP port scan and find that ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) are open. You then perform version detection on these ports. Which additional enumeration step would provide the most valuable information for identifying potential vulnerabilities?

Accepted Answer

Perform banner grabbing on port 22 to identify the SSH version.. Banner grabbing on port 22 (SSH) is the most valuable next step because it directly identifies the SSH server version (e.g., OpenSSH 7.4). Knowing the exact version allows you to cross-reference known vulnerabilities (CVEs) for that specific SSH implementation, which is a common high-risk attack vector during internal penetration tests. While version detection already identified the service, banner grabbing can reveal additional details like patch levels or configuration quirks that version detection might miss.

Answer

Perform SNMP enumeration to gather system information.

Answer

Attempt a DNS zone transfer from the server.

Answer

Enumerate NetBIOS names using `nbtstat`.

Question 11

A network administrator needs to identify all devices on a large corporate network that are running a specific vulnerable version of OpenSSH. The administrator has network access and can use scanning tools. However, scanning the entire network might disrupt operations. Which approach minimizes disruption while accurately identifying the vulnerable hosts?

Accepted Answer

Run a TCP SYN scan on port 22 only, with version detection enabled, across the target IP range.. It targets only TCP port 22 (the default SSH port) with a SYN scan, which is stealthier and faster than a full connect scan, and enables version detection to identify the specific vulnerable OpenSSH version. This minimizes disruption by avoiding scanning unnecessary ports and reduces network load, while accurately pinpointing vulnerable hosts.

Answer

Conduct a full TCP port scan of the entire network using SYN scan.

Answer

Use a ping sweep to identify live hosts, then perform a version scan on each.

Answer

Perform an ARP scan of the entire subnet and then check each host manually.

Question 12

You are conducting a security assessment and need to map the network topology and identify routers, firewalls, and other network devices. Which technique is specifically designed to discover the path packets take to reach a destination and can reveal intermediate devices?

Accepted Answer

Traceroute. Traceroute is the correct technique because it is specifically designed to map the path packets take from a source to a destination by manipulating the Time-to-Live (TTL) field in IP headers. As each hop decrements the TTL, routers along the path send ICMP Time Exceeded messages (or UDP responses in some implementations), revealing their IP addresses and thus identifying intermediate devices like routers and firewalls.

Answer

Banner grabbing

Answer

DNS enumeration

Answer

SNMP walk

Question 13

Which TWO types of information can be obtained through SNMP enumeration on a target device if the community string is 'public'? (Choose two.)

Accepted Answer

List of running processes. SNMP enumeration with the default 'public' community string (read-only access) allows querying MIB objects that expose system information. The 'hostResources' MIB (RFC 2790) includes the 'hrSWRunTable', which lists running processes, and the 'ipRouteTable' (RFC 1213) provides routing table entries. These are standard read-only OIDs accessible without authentication.

Answer

Captured network packets

Answer

User account passwords

Answer

Modify network interface settings

Question 14

Which THREE Nmap options are commonly used to evade firewall detection during a scan? (Choose three.)

Accepted Answer

-f (fragment packets). The -f flag fragments the IP packets into smaller pieces (typically 8-byte fragments) to bypass simple packet-filtering firewalls and intrusion detection systems that do not reassemble fragmented packets before applying filtering rules. This technique exploits the fact that many stateless firewalls only inspect the first fragment and allow subsequent fragments through unchecked, enabling the scan to reach the target.

Answer

-sT (TCP connect scan)

Answer

-sV (version detection)

Question 15

Refer to the exhibit. An Nmap scan shows that port 80 is 'filtered' while ports 22 and 443 are 'open'. What does the 'filtered' state indicate?

Accepted Answer

A firewall, router rule, or host-based firewall is blocking the probes.. When Nmap reports a port as 'filtered', it means that the scan probes (e.g., SYN packets) were dropped or blocked before reaching the target service, typically by a firewall, router ACL, or host-based firewall. Unlike 'open' (which receives a SYN/ACK) or 'closed' (which receives a RST), 'filtered' indicates no response or an ICMP unreachable message, so Nmap cannot confirm whether the port is actually open or closed.

Answer

The port is closed and the target sent a RST packet.

Answer

The port is open but the service is not responding to the scan.

Answer

The port is open but Nmap cannot determine the service.