CEH Footprinting, Reconnaissance and Scanning Practice Question
A security analyst wants to identify all live hosts on a network without generating excessive traffic. Which of the following techniques is MOST appropriate for this purpose?
⚠ Common exam trap
A common mix-up: candidates confuse host discovery with service discovery, choosing a port-based scan (like TCP connect or UDP) because they think 'scanning' always involves ports, but the question explicitly asks for identifying live hosts with minimal traffic, which is the textbook purpose of a ping sweep.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ping sweep using ICMP echo requests
A ping sweep using ICMP Echo Requests (Type 8) is the most efficient method to identify live hosts on a network because it sends a single packet per target and listens for ICMP Echo Replies (Type 0). This generates minimal traffic compared to full port scans, making it ideal for initial reconnaissance without overwhelming the network or triggering intrusion detection systems.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Banner grabbing with Netcat
Why it's wrong here
Banner grabbing with Netcat involves establishing a TCP connection to a specific port on a target IP address and then reading the initial data sent by the service, often revealing its version or type. This technique presupposes that the target host is already known to be live and that a specific port is open and listening for connections. Therefore, it is ineffective for the initial task of identifying all live hosts across a network, as it doesn't perform host discovery but rather service identification on known targets.
- ✗
Full TCP connect scan on all ports
Why it's wrong here
A full TCP connect scan on all ports attempts to complete a three-way handshake (SYN, SYN-ACK, ACK) for every one of the 65,535 possible TCP ports on each IP address within the target network range. While a successful handshake indicates a live host with an open port, this method is extremely resource-intensive and generates an immense volume of network traffic. It is highly inefficient and slow for the sole purpose of identifying live hosts, as its primary goal is detailed port state enumeration.
- ✗
UDP scan on common ports
Why it's wrong here
A UDP scan sends connectionless datagrams to common UDP ports on target hosts, attempting to elicit an ICMP Port Unreachable message if the port is closed. The absence of such a message, or a specific application response, might indicate an open port and thus a live host. However, UDP scanning is inherently slower and less reliable for host discovery due to the stateless nature of UDP and the potential for ICMP responses to be filtered or rate-limited by firewalls, making definitive host identification challenging and less efficient than other methods.
- ✓
Ping sweep using ICMP echo requests
Why this is correct
A ping sweep, also known as an ICMP sweep, is a highly efficient and low-traffic method for host discovery that involves sending ICMP echo request packets to a range of IP addresses. Any host that is live and configured to respond to ICMP will send an ICMP echo reply packet back to the sender. The receipt of these replies reliably indicates the presence of an active host on the network, making it a foundational and quick technique for initial network reconnaissance.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.