CEH Footprinting, Reconnaissance and Scanning Practice Question
A penetration tester wants to identify live hosts on a large IP range without generating excessive network traffic. Which tool is BEST suited for fast host discovery?
⚠ Common exam trap
Watch out — candidates often confuse 'host discovery' with 'vulnerability scanning' or 'OSINT gathering', leading them to choose Nessus or Maltego, but the question specifically asks for minimal traffic and speed, which only Masscan's asynchronous SYN scan achieves.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Masscan
Masscan is the best tool for fast host discovery across large IP ranges because it uses asynchronous transmission and can scan the entire IPv4 address space in under 10 minutes at a rate of 10 million packets per second. It minimizes network traffic by sending only SYN packets and not completing the TCP handshake, making it ideal for rapid live host detection without overwhelming the network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Masscan
Why this is correct
Masscan is specifically engineered for extremely high-speed network scanning, capable of scanning vast IP address spaces, including the entire internet, in minutes. It achieves this by employing an asynchronous, stateless approach to transmit SYN packets at a rapid rate, making it ideal for quickly identifying live hosts and open ports across large address ranges. Its primary strength lies in its ability to conduct broad reconnaissance efficiently, far surpassing other tools for sheer scanning velocity when the objective is rapid host discovery.
- ✗
Maltego
Why it's wrong here
Maltego is an open-source intelligence (OSINT) and graphical link analysis tool designed to gather, visualize, and connect data from various public sources. It excels at mapping relationships between entities like individuals, organizations, domains, and IP addresses, but it does not perform active network scanning to discover live hosts. Its function is data correlation and visualization, not direct network probing to identify active devices.
- ✗
dnsenum
Why it's wrong here
dnsenum is a specialized tool primarily used for DNS enumeration, focusing on extracting information from DNS servers. Its capabilities include discovering subdomains, mail servers, name servers, and performing zone transfer attempts to gather domain-related intelligence. While it can reveal hostnames associated with a domain, its core purpose is not to actively probe IP ranges to confirm the liveness of hosts on a network, but rather to query and analyze DNS records.
- ✗
Nessus
Why it's wrong here
Nessus is a comprehensive vulnerability scanner designed to identify security weaknesses and misconfigurations on target systems. While it includes a basic host discovery phase to identify targets for its in-depth vulnerability checks, this process is typically thorough and resource-intensive, not optimized for rapid, large-scale identification of live hosts across broad network segments. Its strength lies in detailed vulnerability assessment and reporting, not high-speed initial host discovery across a large network.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.