CEH Enumeration and System Hacking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting

  Why this is correct

  The `nmap -sS -sV -O -p 22,80,443,3389` command initiates a TCP SYN scan, often termed a 'stealth scan,' which sends SYN packets without completing the full TCP handshake to identify open ports. Concurrently, the `-sV` flag attempts to detect the specific service and its version running on these ports, while `-O` endeavors to fingerprint the target's operating system. The `-p` flag precisely limits this comprehensive reconnaissance to only ports 22, 80, 443, and 3389, making it a highly targeted information gathering effort.

• ✗

  Perform a full TCP connect scan with UDP service detection on all ports

  Why it's wrong here

  This option is incorrect because the `-sS` flag explicitly performs a TCP SYN scan, not a full TCP connect scan, which would require the `-sT` flag. Furthermore, the `-sV` flag is designed for detecting *TCP* service versions, not UDP services, which typically necessitates the `-sU` flag for scanning and then `-sV` for version detection. Lastly, the `-p` argument clearly specifies only four ports, directly contradicting the assertion of scanning 'all ports'.

• ✗

  Perform an aggressive scan of all open ports and enumerate SMB shares

  Why it's wrong here

  This statement is inaccurate as the command provided does not include the `-A` flag, which is essential for an aggressive scan that encompasses a broader range of detection and scripting. The `-p` argument explicitly limits the scan to only four specific ports, not 'all open ports' as suggested. Moreover, enumerating SMB shares typically requires specific Nmap scripting, such as `--script smb-enum-shares`, which is absent from the command, and SMB services usually run on port 445, which is not included in the specified port list.

• ✗

  Perform a UDP scan on the four specified ports and identify running services

  Why it's wrong here

  This option is incorrect because the `-sS` flag designates a TCP SYN scan, not a UDP scan. To perform a UDP scan, the `-sU` flag must be used, which sends UDP packets to target ports. While `-sV` is present for service detection, it would only attempt to identify TCP services on the specified ports, as the primary scan method is TCP-based, rendering it ineffective for UDP service identification without the `-sU` flag.

Go deeper

Related to this question