CEH Footprinting, Reconnaissance and Scanning Practice Question
A security analyst runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?
⚠ Common exam trap
Many candidates confuse `-sS` (SYN scan) with a full connect scan or UDP scan, or assume that specifying `-p` implies scanning all ports, when in fact it limits the scan to only the listed ports.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting
The command `nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24` performs a TCP SYN scan (`-sS`) on only the four specified ports, enables service version detection (`-sV`), and attempts OS fingerprinting (`-O`). This is a stealthy half-open scan that does not complete the TCP three-way handshake, combined with banner grabbing and OS detection, limited to the given port list.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perform an aggressive scan of all open ports and enumerate SMB shares
Why it's wrong here
This option is incorrect because the Nmap command does not include the `-A` flag, which is required to enable aggressive scan mode. Additionally, the `-p` flag explicitly limits the scan to only four specific ports (22, 80, 443, 3389), not all open ports. SMB share enumeration typically requires specific Nmap Scripting Engine (NSE) scripts like `--script smb-enum-shares` and targets port 445, neither of which are present or implied by the given command.
- ✓
Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting
Why this is correct
This option accurately describes the Nmap command's functionality. The `-sS` flag initiates a TCP SYN scan, also known as a stealth scan, which is efficient and less likely to be logged by firewalls. The `-sV` flag enables service version detection, attempting to determine the application and version running on open ports. Additionally, the `-O` flag performs operating system detection, and the `-p` flag explicitly targets only ports 22, 80, 443, and 3389.
- ✗
Perform a UDP scan on the four specified ports and identify running services
Why it's wrong here
This option is incorrect because the `-sS` flag specifies a TCP SYN scan, which is a TCP-based scan, not a UDP scan. To perform a UDP scan, the `-sU` flag would be required in the Nmap command. While the command does target the four specified ports, the service identification with `-sV` primarily focuses on TCP services and would not effectively identify UDP services without the appropriate scan type.
- ✗
Perform a full TCP connect scan with UDP service detection on all ports
Why it's wrong here
This option is incorrect on multiple counts. The `-sS` flag initiates a TCP SYN scan, which is a half-open scan, not a full TCP connect scan (which uses the `-sT` flag). Furthermore, the `-sV` flag is designed for TCP service version detection and does not perform UDP service detection. Lastly, the `-p 22,80,443,3389` argument explicitly limits the scan to only four specific ports, rather than scanning all available ports.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.