20+ practice questions focused on Footprinting, Reconnaissance and Scanning — one of the most tested topics on the Certified Ethical Hacker CEH exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Footprinting, Reconnaissance and Scanning PracticeA penetration tester is attempting to evade an IDS/IPS while performing a port scan. They use the Nmap command: nmap -sS -f --data-length 20 -D RND:10 10.0.0.1. Which techniques are being employed to evade detection?
Explanation: The explanation accurately identifies the three distinct evasion techniques from the Nmap command: fragmentation (-f), decoy scanning (-D RND:10), and packet data padding (--data-length 20). However, the explanation does not fully justify the marked correct option C, as option C fails to include 'packet data padding' and instead lists 'using a random source IP' which is either a consequence or rephrasing of the decoy technique, not a distinct third technique as identified by the command's flags.
Which THREE of the following are valid DNS record types that an attacker might query during reconnaissance to gather information about a target domain? (Select 3)
Explanation: The A record maps a domain name to an IPv4 address, which is fundamental for locating a target server. During reconnaissance, querying A records reveals the IP address of the target domain, enabling further scanning and attack planning. The NS (Name Server) record identifies the authoritative DNS servers for a domain, providing insight into the target's DNS infrastructure and potential points of attack or misconfiguration. The MX (Mail Exchange) record specifies the mail servers responsible for accepting email for a domain, which is crucial for identifying email infrastructure, potential phishing targets, or email server vulnerabilities. These are all standard DNS query types defined in RFC 1035 and are highly valuable for attackers during reconnaissance.
A security analyst observes unusual outbound traffic from an internal host to an external IP on port 443. The analyst suspects a reverse shell where the internal host initiates an HTTPS connection to the attacker. Which Nmap script would be MOST useful to confirm the nature of this traffic if the analyst can run a scan on the internal host?
Explanation: tls-nextprotoneg is correct because it detects the TLS Next Protocol Negotiation (NPN) extension. Reverse shells often use NPN/ALPN to establish non-standard application-layer protocols over HTTPS to evade detection. If the analyst runs Nmap *from* the internal host *targeting the external IP*, this script can probe the external server to reveal if the TLS session it offers is attempting to negotiate a protocol other than standard HTTP, which would indicate a reverse shell command and control (C2) server.
A penetration tester runs `nmap -sS -sV -O -p- 192.168.1.10` and receives the following output snippet: 'PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4 80/tcp open http Apache httpd 2.4.6 443/tcp open ssl/http Apache httpd 2.4.6'. Which THREE pieces of information can the tester derive from this output? (Choose 3)
Explanation: The `-sV` flag in Nmap explicitly enables version detection, which probes open ports to determine the service and version information displayed in the output (e.g., 'OpenSSH 7.4', 'Apache httpd 2.4.6'). This directly supports option B. The output also explicitly states 'Apache httpd 2.4.6', confirming option C. However, the provided output snippet does not include any information about the target's operating system, making option E not derivable from the snippet.
Which TWO of the following are valid port states that Nmap can report? (Select 2)
Explanation: Nmap reports 'Open' when a port responds to a probe (e.g., SYN, ACK, or connect scan) with a positive acknowledgment, indicating a service is actively listening. It reports 'Filtered' when packet filtering (e.g., a firewall) prevents Nmap's probes from reaching the port, making it impossible to determine if the port is open or closed. These are two of the six fundamental port states defined in Nmap's output, directly derived from TCP/IP protocol behavior during the scan.
+15 more Footprinting, Reconnaissance and Scanning questions available
Practice all Footprinting, Reconnaissance and Scanning questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Footprinting, Reconnaissance and Scanning. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Footprinting, Reconnaissance and Scanning questions on the CEH frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Footprinting, Reconnaissance and Scanning is tested as part of the Certified Ethical Hacker CEH blueprint. Practicing with targeted Footprinting, Reconnaissance and Scanning questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CEH practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Footprinting, Reconnaissance and Scanning is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Footprinting, Reconnaissance and Scanning practice session with instant scoring and detailed explanations.
Start Footprinting, Reconnaissance and Scanning Practice →