CEH Footprinting, Reconnaissance and Scanning Practice Question

A security analyst observes the following Nmap output for a target host: PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https. The analyst then runs a version detection scan and notices that port 80 reports 'Apache httpd 2.4.41' but port 443 reports 'Apache httpd 2.4.41' as well. What is the MOST likely conclusion?

⚠ Common exam trap

Many exam-takers assume different ports must mean different servers or a reverse proxy, but the CEH exam expects you to recognize that identical version strings from Nmap -sV indicate a single web server instance handling both protocols.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The target is likely running a single web server that handles both HTTP and HTTPS traffic

When both port 80 (HTTP) and port 443 (HTTPS) report the same Apache httpd version (2.4.41), it strongly indicates that the same web server process is listening on both ports. Apache httpd can be configured to handle both plain HTTP and TLS-encrypted HTTPS traffic simultaneously, typically using separate VirtualHost directives or a single configuration that binds to both ports. The identical version string makes it unlikely that two separate web server instances are running, as they would often differ in patch level or configuration.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The target is running two separate web servers on different ports
Why it's wrong here
While it is technically possible to run two distinct web server applications on different ports, the Nmap output showing the exact same version of Apache httpd (e.g., 2.4.x) on both port 80 and port 443 strongly indicates a single server instance. Configuring two entirely separate server processes for the same service, especially with identical versions, is an inefficient and uncommon setup compared to a single server listening on multiple ports.
✓
The target is likely running a single web server that handles both HTTP and HTTPS traffic
Why this is correct
This option represents the most common and standard configuration for a modern web server. A single instance of web server software, such as Apache or Nginx, is typically configured to listen on both port 80 for unencrypted HTTP traffic and port 443 for secure HTTPS communication. The Nmap output identifying the same server version on both ports directly supports this interpretation, as the server handles both protocols from a unified configuration.
✗
The target is running a reverse proxy that forwards traffic to different backends
Why it's wrong here
While a reverse proxy does listen on standard web ports and forwards traffic, Nmap's version detection would typically identify the proxy software itself (e.g., Nginx, HAProxy) rather than the specific backend web server version like Apache httpd. Without additional identifying banners or HTTP headers that explicitly indicate proxy functionality, inferring a reverse proxy solely from a consistent web server banner on both ports is speculative and not the most direct conclusion.
✗
The version detection is incorrect due to false positives
Why it's wrong here
Nmap's service and version detection (-sV) is highly robust and generally very accurate, especially for widely deployed and standardized services like Apache HTTP Server running on its default ports. It employs a sophisticated database of probes and signature matching to identify services reliably. While no automated detection is 100% infallible, a false positive for such a common and well-defined service is highly unlikely without specific network anomalies or deliberate obfuscation techniques.

Go deeper

CEH Footprinting, Reconnaissance and Scanning Practice Question

Why each option matters

Option-by-option breakdown

Related to this question