CEH Footprinting, Reconnaissance and Scanning Practice Question
A penetration tester uses the following Nmap command: nmap -sS -O -p 1-1000 10.0.0.1. The output shows port 22 as open, and OS detection suggests 'Linux 2.6.x'. The tester then runs: nmap -sV -p 22 10.0.0.1. What additional information does the second scan provide?
⚠ Common exam trap
A common mix-up: candidates confuse OS detection (`-O`) with service version detection (`-sV`), leading candidates to think `-sV` confirms the OS when it actually identifies the application version running on the port.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It identifies the version of the SSH service running
The second scan uses the `-sV` flag, which enables version detection. Nmap probes the open port 22 (SSH) to determine the exact service version (e.g., OpenSSH 5.3p1). This is distinct from OS detection (`-O`), which guesses the operating system based on TCP/IP stack fingerprinting. The `-sV` scan provides granular service version information, not OS confirmation or firewall status.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It confirms the OS is Linux 2.6.x
Why it's wrong here
The -sV flag in Nmap is specifically designed for service version detection, not operating system identification. OS detection is typically performed using the -O flag, which analyzes various TCP/IP stack characteristics, such as initial TCP window size, SYN packet options, and IP ID sequence. Therefore, while Nmap can detect the OS, -sV alone does not provide this information directly, as its focus is on the application layer service.
- ✗
It checks if the port is filtered by a firewall
Why it's wrong here
The -sV command primarily focuses on identifying the specific software version running on an open port, not on determining firewall filtering status. While Nmap can infer filtering based on port states (e.g., no response to SYN packets or ICMP unreachable messages), this is part of the initial port scan type (like a SYN scan), not the version detection phase itself. Version scanning only proceeds once a port is identified as open, making it unsuitable for directly assessing firewall rules that block access.
- ✓
It identifies the version of the SSH service running
Why this is correct
The -sV flag instructs Nmap to perform service version detection on the specified port, which in this context is port 22, commonly used for SSH. Nmap achieves this by sending various probes to the port and analyzing the responses, often comparing banner grabs or protocol handshakes against its extensive service signature database. This process accurately identifies the specific SSH daemon and its version, such as OpenSSH 8.2p1, providing crucial intelligence for vulnerability assessment.
- ✗
It performs a UDP scan on port 22
Why it's wrong here
A UDP scan specifically targets UDP ports and requires the -sU flag in Nmap to be explicitly enabled. Port 22 is the standard, well-known port for the Secure Shell (SSH) protocol, which exclusively operates over TCP, not UDP. Therefore, using -sV on port 22, without the -sU flag, will default to a TCP-based version scan, attempting to identify the TCP service running on that port.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.