CEH Practice Question: Malware, Social Engineering and Network Attacks
A penetration tester uses the following command to scan a target: nmap -sU -sV -p 53,161,162 10.0.0.1. Which of the following BEST describes what this scan will accomplish?
⚠ Common exam trap
Candidates often confuse `-sU` (UDP scan) with `-sS` (TCP SYN scan) or assume that `-sV` implies OS detection, when in fact `-sV` is strictly for service version detection and OS detection requires the `-O` flag.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
UDP scan on three ports with service version detection
The `-sU` flag initiates a UDP scan, `-p 53,161,162` limits the scan to those three specific ports, and `-sV` enables service version detection. This combination performs a UDP scan on only the specified ports and attempts to identify the versions of services running on them.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Full port scan of all 65535 UDP ports
Why it's wrong here
This option is incorrect because the Nmap command explicitly specifies ports 53, 161, and 162 using the -p flag. Without the -p- flag or omitting the -p flag entirely (which would scan the 1000 most common ports by default), Nmap will not scan all 65535 UDP ports. Therefore, the scan is highly targeted to specific services, not a comprehensive full port scan across the entire UDP range.
- ✗
Ping sweep and OS detection on the target
Why it's wrong here
This option is incorrect because the Nmap command does not include the -sn (ping scan) flag, which is used for host discovery without performing a full port scan. Furthermore, the -O flag, essential for enabling Nmap's operating system detection capabilities through TCP/IP fingerprinting, is also absent. The command focuses on detailed port and service scanning, not initial host discovery or OS fingerprinting.
- ✓
UDP scan on three ports with service version detection
Why this is correct
This option accurately describes the Nmap command's functionality. The -sU flag specifically instructs Nmap to perform a UDP port scan, targeting services that communicate via the User Datagram Protocol. Concurrently, the -sV flag enables service version detection, attempting to identify the application and its version running on any discovered open UDP ports. The -p 53,161,162 argument precisely limits this comprehensive scan to three specific UDP ports.
- ✗
TCP SYN scan on ports 53, 161, 162 with version detection
Why it's wrong here
This option is incorrect because a TCP SYN scan is performed using the -sS flag, which establishes a half-open TCP connection to determine port status. The command in question, however, utilizes the -sU flag, which specifically designates a UDP scan. UDP scans send UDP packets to target ports and analyze responses, a distinct method from TCP-based scanning. Therefore, the protocol type is fundamentally misrepresented.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.