CEH Footprinting, Reconnaissance and Scanning Practice Question
A penetration tester is conducting a vulnerability scan against a target network. Which of the following tools is BEST suited for this task?
⚠ Common exam trap
Many exam-takers confuse network scanning (Nmap) with vulnerability scanning (Nessus), assuming that any tool that discovers open ports can also assess vulnerabilities, but CEH distinguishes between reconnaissance tools and dedicated vulnerability assessment tools.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Nessus
Nessus is a dedicated vulnerability scanner that automates the process of identifying known vulnerabilities, misconfigurations, and missing patches across a target network. It uses a large plugin database (e.g., NASL scripts) to perform non-intrusive checks against services and operating systems, making it the best tool for a vulnerability scan. Unlike general-purpose tools, Nessus is specifically designed to correlate scan results with CVE entries and provide risk ratings, which is the core requirement of a vulnerability assessment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Nessus
Why this is correct
Nessus is a leading commercial vulnerability scanner designed to identify security weaknesses across a wide range of systems and applications. It actively probes targets for misconfigurations, missing security patches, default credentials, and known vulnerabilities (CVEs) by comparing system responses against an extensive, frequently updated vulnerability database. Its comprehensive reporting capabilities provide actionable insights for remediation, making it an essential tool for proactive vulnerability management programs.
- ✗
Nmap
Why it's wrong here
Nmap (Network Mapper) is primarily a powerful open-source utility for network discovery and security auditing, excelling at host discovery, port scanning, and service version detection. While its Nmap Scripting Engine (NSE) allows for some basic vulnerability checks and information gathering, these scripts are generally more targeted and less comprehensive than the deep, automated assessments performed by dedicated vulnerability scanners. Nmap's strength lies in initial reconnaissance and mapping network topography, rather than exhaustive vulnerability identification.
- ✗
Wireshark
Why it's wrong here
Wireshark functions as a robust network protocol analyzer, enabling the capture and interactive inspection of network traffic in real-time or from saved files. Its primary purpose is to diagnose network issues, analyze protocol implementations, and understand data flows by dissecting individual packets. Unlike vulnerability scanners, Wireshark is a passive tool that observes network communications without actively probing systems for security flaws or misconfigurations, making it unsuitable for direct vulnerability assessment.
- ✗
Metasploit
Why it's wrong here
Metasploit is a sophisticated open-source penetration testing framework primarily utilized for developing, testing, and executing exploit code against identified vulnerabilities. While it includes auxiliary modules capable of performing some reconnaissance and limited scanning functions, its core design is centered around the post-vulnerability exploitation phase of a penetration test. It is not engineered to provide the comprehensive, automated vulnerability identification and reporting that dedicated vulnerability scanners offer across an entire network infrastructure.
Go deeper
Related to this question
Learn chapter
Vulnerability Analysis
Key term
Vulnerability assessment
A vulnerability assessment is a systematic review of security weaknesses in an information system, evaluating if the system is susceptible to any known vulnerabilities, assigning severity levels, and recommending remediation or mitigation.
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.