CEH Footprinting, Reconnaissance and Scanning Practice Question
A penetration tester is scanning a target and receives the output: 'PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https'. Which Nmap flag was MOST likely used to obtain this output?
⚠ Common exam trap
A common mix-up: candidates confuse the service name mapping (from -sS or default scan) with version detection (-sV), assuming that seeing 'ssh' or 'http' implies version probing occurred, when in fact Nmap simply maps the port number to a common service name from its database.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
-sS
The output shows open ports with their service names (ssh, http, https) but no version information. The -sS flag performs a SYN stealth scan, which by default probes common ports and uses the /etc/services file to map port numbers to service names. This matches the output format exactly, as -sS does not perform version detection or OS fingerprinting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
-sS
Why this is correct
The -sS option performs a SYN scan, which is Nmap's default and most common scanning method. This "half-open" scan sends a SYN packet to each target port and, if a SYN/ACK is received, the port is marked as open before a full TCP connection is established. This efficient technique quickly identifies open ports and infers service names based on standard port assignments, making it ideal for initial reconnaissance without completing the three-way handshake.
- ✗
-O
Why it's wrong here
The -O option in Nmap is specifically designed for operating system detection. It attempts to fingerprint the target's OS by analyzing various characteristics of its TCP/IP stack, such as initial TCP window size, IP ID sequence, and specific TCP options. The output from an -O scan would include detailed OS information (e.g., "Linux 4.15 - 5.6"), which is distinct from merely listing open ports and their generic service names.
- ✗
-A
Why it's wrong here
The -A option initiates an aggressive scan, which is a comprehensive mode that combines multiple advanced Nmap features. This includes OS detection (-O), service version detection (-sV), script scanning (-sC), and traceroute. An aggressive scan would yield a significantly more verbose output, detailing specific OS versions, exact application versions (e.g., "OpenSSH 7.4p1"), and potentially vulnerability information, far exceeding a simple list of service names.
- ✗
-sV
Why it's wrong here
The -sV option is used for service version detection, which runs after Nmap has identified open ports. Its purpose is to determine the precise application and its version running on each open port by sending various probes and analyzing the responses. The output would typically show granular details like "OpenSSH 7.4p1 Debian 10+deb10u2" instead of just the generic service name "ssh," providing much more specific information than implied.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.