CEH Scanning Networks and Enumeration Practice Question

A network administrator needs to identify all devices on a large corporate network that are running a specific vulnerable version of OpenSSH. The administrator has network access and can use scanning tools. However, scanning the entire network might disrupt operations. Which approach minimizes disruption while accurately identifying the vulnerable hosts?

⚠ Common exam trap

Test-takers frequently choose a ping sweep (Option C) thinking it reduces disruption, but they overlook that ICMP may be blocked, and the subsequent version scan on each host still requires port-level scanning, making Option B more efficient and accurate.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Run a TCP SYN scan on port 22 only, with version detection enabled, across the target IP range.

It targets only TCP port 22 (the default SSH port) with a SYN scan, which is stealthier and faster than a full connect scan, and enables version detection to identify the specific vulnerable OpenSSH version. This minimizes disruption by avoiding scanning unnecessary ports and reduces network load, while accurately pinpointing vulnerable hosts.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Conduct a full TCP port scan of the entire network using SYN scan.
Why it's wrong here
A full TCP port scan, which attempts to connect to all 65,535 possible TCP ports across an entire network range, is highly inefficient and disruptive. This extensive scanning generates a massive volume of network traffic, significantly increasing the likelihood of detection by intrusion detection systems (IDS) and potentially causing performance degradation on network devices due to the sheer number of connection attempts.
✓
Run a TCP SYN scan on port 22 only, with version detection enabled, across the target IP range.
Why this is correct
This approach is highly efficient and targeted for identifying devices running a specific service. A TCP SYN scan on port 22 (SSH) across the target IP range quickly identifies hosts listening on this port without establishing a full connection, thus minimizing network overhead and remaining relatively stealthy. Enabling version detection simultaneously gathers crucial information about the SSH service's software version, which is essential for identifying potential vulnerabilities without further extensive scanning.
✗
Use a ping sweep to identify live hosts, then perform a version scan on each.
Why it's wrong here
While a ping sweep (ICMP echo request) can effectively identify live hosts that respond to pings, it only confirms host presence and does not reveal open ports or running services. Subsequently performing a version scan on *each* identified live host would still require a separate, potentially extensive port scan for each host to determine service versions, making it a two-step, less efficient, and more time-consuming process compared to directly scanning the target port with version detection.
✗
Perform an ARP scan of the entire subnet and then check each host manually.
Why it's wrong here
An ARP scan is effective for discovering all active hosts on a local subnet by mapping IP addresses to MAC addresses, confirming their presence on the network segment. However, after identifying these hosts, the requirement to "check each host manually" is extremely impractical and time-consuming for any sizable network. Manual checking provides no automated way to gather service version information and is highly inefficient for vulnerability assessment or even basic device inventory.

Go deeper

CEH Scanning Networks and Enumeration Practice Question

Why each option matters

Option-by-option breakdown

Related to this question