Courseiva

CCNA Footprinting, Reconnaissance and Scanning Questions

75 of 140 questions · Page 1/2 · Footprinting, Reconnaissance and Scanning · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

During a vulnerability scan using Nessus, a security analyst discovers that the target host shows a 'High' severity vulnerability for 'SSL/TLS Renegotiation DoS'. What does this vulnerability indicate?

A.The server does not validate SSL certificates
B.The server supports SSLv2
C.The server allows weak cipher suites
D.An attacker can force the server to renegotiate TLS handshakes repeatedly, causing resource exhaustion
AnswerD

This option accurately describes the SSL/TLS Renegotiation DoS vulnerability, where an attacker initiates numerous partial TLS handshakes, specifically requesting renegotiation of the secure channel. Each renegotiation requires significant computational effort from the server, involving cryptographic operations like key exchanges and certificate validations. By repeatedly forcing these resource-intensive operations, an attacker can exhaust the server's CPU and memory, leading to a denial of service for legitimate users.

Why this answer

The SSL/TLS Renegotiation DoS vulnerability (CVE-2011-1473) occurs when a server supports TLS renegotiation without proper rate limiting. An attacker can open multiple connections and repeatedly request renegotiation, causing the server to consume excessive CPU resources for cryptographic handshake calculations, effectively leading to a denial of service. Nessus flags this as 'High' severity because it can exhaust server resources even with a single attacker.

Exam trap

The trap here is that candidates often confuse this DoS vulnerability with weak cipher suites or protocol version issues, but the core distinction is that renegotiation DoS is about resource exhaustion from repeated handshakes, not about encryption strength or certificate trust.

How to eliminate wrong answers

Option A is wrong because the vulnerability is about renegotiation resource exhaustion, not certificate validation; certificate validation issues are typically flagged as 'SSL Certificate Cannot Be Trusted' or 'Self-Signed Certificate' vulnerabilities. Option B is wrong because SSLv2 support is a separate vulnerability (e.g., 'SSLv2 Protocol Detection') related to weak protocol versions, not renegotiation attacks; SSLv2 was deprecated due to cipher suite weaknesses, not renegotiation DoS. Option C is wrong because weak cipher suites (e.g., RC4, DES, or export-grade ciphers) are flagged under 'SSL Weak Cipher Suites' vulnerabilities, which concern encryption strength, not the renegotiation handshake process that causes CPU exhaustion.

Practice this question →
2
MCQmedium

During a penetration test, the tester uses a tool that queries search engines with specific operators to find sensitive information such as login pages, exposed directories, and file types. Which tool or technique is being used?

A.Shodan
B.theHarvester
C.Google dorking
D.DNS zone transfer
AnswerC

Google dorking, also known as Google Hacking, involves using advanced search operators (dorks) within search engines like Google to uncover publicly accessible, yet often unintendedly exposed, sensitive information. Operators such as `site:`, `filetype:`, `intitle:`, `inurl:`, and `cache:` allow testers to narrow down searches to specific domains, file types, page titles, URLs, or cached versions, effectively querying the search engine's index for misconfigurations or leaked data. This directly matches the scenario of a tester using a tool that queries via search engine operators.

Why this answer

Google dorking (also known as Google hacking) uses advanced search operators (e.g., intitle:, filetype:, inurl:) to uncover sensitive information indexed by search engines, such as login pages, exposed directories, and specific file types. This technique directly matches the description of querying search engines with operators to find hidden or sensitive data.

Exam trap

The trap here is that candidates often confuse Google dorking with Shodan, because both involve search engines, but Shodan searches for devices and services (e.g., open ports, banners) rather than web content indexed by Google's crawlers.

How to eliminate wrong answers

Option A is wrong because Shodan is a search engine for internet-connected devices (e.g., IoT, servers, webcams) and does not use search engine operators to find login pages or file types within web content. Option B is wrong because theHarvester is a tool for gathering email addresses, subdomains, and names from public sources (e.g., search engines, PGP key servers), but it does not focus on querying with operators to find login pages or exposed directories. Option D is wrong because DNS zone transfer is a technique to request all DNS records from a nameserver (using AXFR/IXFR queries), not a search engine query method for sensitive web content.

Practice this question →
3
MCQeasy

Which of the following techniques involves sending crafted packets to a target to elicit responses that reveal the operating system?

A.Passive OS fingerprinting
B.Banner grabbing
C.DNS enumeration
D.Active OS fingerprinting
AnswerD

Active OS fingerprinting is the precise technique that involves sending specially crafted packets to a target system and analyzing the responses to infer its operating system. These crafted packets often include unusual TCP flags, specific IP options, or non-standard ICMP requests designed to exploit subtle differences in how various operating systems implement their TCP/IP stacks. The unique replies, or lack thereof, provide distinct clues about the target's OS and version.

Why this answer

Active OS fingerprinting involves sending crafted packets (e.g., TCP SYN, FIN, or ICMP probes) to a target and analyzing the responses to deduce the operating system. Unlike passive methods, it actively interacts with the target, leveraging subtle differences in how various OSes implement TCP/IP stack behaviors (e.g., initial TTL values, window sizes, or TCP option ordering). This technique is commonly used by tools like Nmap with its `-O` flag.

Exam trap

The trap here is that candidates often confuse 'active OS fingerprinting' with 'banner grabbing' because both involve sending packets, but banner grabbing targets application-layer banners (e.g., HTTP, FTP) and not the OS-level TCP/IP stack responses that fingerprinting analyzes.

How to eliminate wrong answers

Option A is wrong because passive OS fingerprinting does not send any packets; it only sniffs network traffic to infer the OS from observed packet characteristics (e.g., TTL, DF flag), avoiding direct interaction. Option B is wrong because banner grabbing retrieves application-layer service banners (e.g., HTTP Server header) to identify software versions, not the underlying OS, and it relies on application responses rather than network stack behavior. Option C is wrong because DNS enumeration queries DNS servers for records (e.g., A, MX, NS) to map a domain's infrastructure, not to determine the operating system of a host.

Practice this question →
4
MCQmedium

A security analyst is conducting a vulnerability scan on a web server using Nessus. After the scan, they notice that the server's performance has degraded significantly, and some services have become unresponsive. Which of the following actions could have prevented this issue?

A.Increase the scan intensity to complete faster and reduce the load
B.Configure Nessus to use a 'safe' scan policy that disables disruptive plugins
C.Use a different scanner like OpenVAS which is less intrusive
D.Run the scan during peak hours to blend in with normal traffic
AnswerB

Configuring Nessus with a 'safe' scan policy is the most appropriate action because it specifically disables plugins known to be disruptive or potentially harmful to target systems. These plugins often include checks that perform denial-of-service tests, brute-force authentication attempts, or highly resource-intensive operations that could crash services or cause system instability. By avoiding these aggressive checks, the scan can identify vulnerabilities without negatively impacting the availability or performance of critical systems.

Why this answer

Nessus 'safe' scan policies disable plugins known to cause service disruption, such as those performing denial-of-service tests or exploiting vulnerabilities that may crash services. By using a safe policy, the analyst avoids aggressive checks that can degrade server performance or cause unresponsiveness, which is a common risk during vulnerability scanning.

Exam trap

The trap here is that candidates may think using a different scanner (Option C) or adjusting timing (Option D) solves the problem, but the core issue is the use of disruptive plugins, which is directly controlled by the scan policy, not the scanner brand or schedule.

How to eliminate wrong answers

Option A is wrong because increasing scan intensity (e.g., using more concurrent threads or faster timing) actually increases the load on the target, worsening performance degradation and service unresponsiveness. Option C is wrong because OpenVAS is not inherently less intrusive; it also includes aggressive plugins that can disrupt services, and the issue is about scan policy, not the scanner brand. Option D is wrong because running the scan during peak hours increases the risk of impacting production traffic and does not prevent disruptive plugins from causing service issues; it may even amplify the impact on users.

Practice this question →
5
MCQmedium

A security analyst runs the following command: hping3 -S -p 80 -c 1 192.168.1.1. The response received is an RST/ACK packet. What does this indicate about port 80 on the target?

A.The port is open and listening
B.The port is filtered by a firewall
C.The port is closed
D.The port is in a TIME_WAIT state
AnswerC

RST/ACK indicates the port is closed.

Why this answer

When hping3 sends a SYN packet to a closed port, the target responds with an RST/ACK packet per TCP RFC 793. This indicates that the port is reachable but no service is listening on it, hence the immediate reset.

Exam trap

The trap here is that candidates often confuse a RST/ACK response with a filtered port or assume it indicates a firewall blocking the port, but in TCP, a closed port actively sends RST/ACK, whereas a firewall typically drops the packet silently.

How to eliminate wrong answers

Option A is wrong because an open port would respond with a SYN/ACK, not an RST/ACK. Option B is wrong because a filtered port would typically drop the packet silently or respond with an ICMP unreachable message, not a TCP RST/ACK. Option D is wrong because TIME_WAIT is a local TCP state on the client side after a connection closes, not a response from a remote port to a SYN probe.

Practice this question →
6
Multi-Selecthard

Which THREE of the following are valid Nmap flags that can be used to evade detection by an IDS? (Select exactly 3.)

Select 3 answers
A.-O
B.-D
C.-f
D.-sS
E.--data-length
AnswersB, C, E

The -D <decoy1,decoy2,ME,...> flag initiates a decoy scan, which is a powerful evasion technique designed to obscure the true source of the Nmap scan. By sending packets from multiple spoofed IP addresses alongside the real scanner's IP, it makes it significantly harder for Intrusion Detection Systems (IDS) and firewalls to pinpoint the actual origin of the scan activity. This creates a smokescreen, distributing the apparent attack source across numerous hosts and complicating forensic analysis.

Why this answer

(-D) is correct because the decoy scan flag allows you to spoof multiple source IP addresses, making it difficult for an IDS to distinguish the real scanning host from the decoys. This technique floods the target with scan traffic from many IPs, obscuring the true origin and evading detection.

Exam trap

EC-Council often tests the misconception that -sS is an evasion technique, but it is actually a stealth scan that reduces connection logging, not IDS evasion; the real evasion flags are those that alter packet structure or source identity.

Practice this question →
7
MCQhard

A penetration tester uses the following Google dork: intitle:"index of" "backup" site:example.com. What is the MOST likely goal of this search?

A.Locate open directories that might contain sensitive files
B.Discover email addresses associated with the domain
C.Find login pages of the target domain
D.Identify subdomains of example.com
AnswerA

The `intitle:"index of"` Google dork specifically targets web server directory listings that lack proper configuration to prevent browsing. When combined with keywords like `(backup|bak|old|temp)` (implied by the context of sensitive files), it effectively filters for directories likely containing sensitive, unindexed files such as database backups, configuration files, or temporary data. This technique is a highly effective reconnaissance method for uncovering misconfigurations that expose critical information.

Why this answer

The Google dork `intitle:"index of" "backup" site:example.com` targets web servers that have directory listing enabled (indicated by the page title containing 'index of') and that contain a folder or file named 'backup'. This is a classic reconnaissance technique to find open directories where backup files (e.g., database dumps, configuration files) may be inadvertently exposed, potentially containing sensitive data such as credentials or proprietary information.

Exam trap

The trap here is that candidates often confuse the purpose of Google dorks, thinking 'index of' always reveals login pages or subdomains, when in fact it specifically identifies directories with listing enabled, and the 'backup' keyword pinpoints potentially sensitive data exposure.

How to eliminate wrong answers

Option B is wrong because discovering email addresses typically uses dorks like `intext:"@example.com"` or `site:example.com intitle:"contact"`, not directory listing indicators. Option C is wrong because finding login pages usually involves dorks such as `inurl:login` or `inurl:admin`, not the 'index of' and 'backup' keywords. Option D is wrong because identifying subdomains is better achieved with dorks like `site:*.example.com` or tools like Sublist3r, not by searching for directory listings containing 'backup'.

Practice this question →
8
MCQmedium

An analyst runs the following command: dnsenum --enum example.com. Which of the following actions is dnsenum performing?

A.Attempts a zone transfer and brute-forces subdomains
B.Scans for open ports on the DNS server
C.Queries the DNS server for its version information
D.Performs a reverse DNS lookup to find PTR records for the IP range
AnswerA

The `dnsenum enum exampl` command, specifically utilizing the `enum` option, instructs the `dnsenum` tool to perform a comprehensive DNS reconnaissance. This process primarily involves attempting a zone transfer (AXFR) from the target DNS server, which, if successful due to misconfiguration, can reveal all DNS records for the domain. Following this, `dnsenum` proceeds to brute-force subdomains by iterating through a built-in or user-provided wordlist, querying for A records to discover additional hosts within the domain.

Why this answer

The `dnsenum` tool is designed for DNS enumeration, and its `--enum` flag performs a comprehensive scan that includes attempting a zone transfer (AXFR query) to retrieve all DNS records from the nameserver, and if that fails, it brute-forces subdomains using a wordlist. This matches option A exactly.

Exam trap

The trap here is that candidates confuse `dnsenum` with other DNS tools like `nslookup` or `dig`, assuming it only performs simple queries, when in fact its `--enum` mode specifically targets zone transfers and subdomain brute-forcing.

How to eliminate wrong answers

Option B is wrong because `dnsenum` does not perform port scanning; that is the role of tools like Nmap or Masscan. Option C is wrong because querying the DNS server for its version information is typically done with `dig chaos TXT VERSION.BIND` or `fpdns`, not `dnsenum`. Option D is wrong because reverse DNS lookups for PTR records are not a primary function of `dnsenum`; that is better suited for tools like `dnsrecon` with specific flags or `nslookup` in reverse mode.

Practice this question →
9
MCQeasy

Which of the following tools is specifically designed to search the internet for exposed devices and services, such as industrial control systems and webcams, using banners and metadata?

A.Maltego
B.Nmap
C.Shodan
D.Google
AnswerC

Shodan functions as a specialized search engine that continuously scans the entire internet, indexing information derived from service banners, metadata, and open ports of various internet-connected devices. Unlike traditional web search engines, Shodan focuses on machine-readable data, enabling users to discover a vast array of devices, including industrial control systems, webcams, routers, and IoT devices, based on specific criteria like manufacturer, location, or exposed service. This unique capability makes it an indispensable tool for security researchers and penetration testers to identify vulnerable or misconfigured systems globally.

Why this answer

Shodan is a search engine specifically designed to scan the internet for exposed devices and services by collecting banners and metadata from protocols such as HTTP, SSH, FTP, and SNMP. Unlike general-purpose search engines, Shodan indexes device-specific information, making it ideal for discovering industrial control systems (ICS), webcams, and other IoT devices that respond to network probes.

Exam trap

The trap here is that candidates confuse Shodan with a general-purpose search engine like Google or a network mapping tool like Nmap, failing to recognize that Shodan is purpose-built for indexing device banners and metadata from internet-connected systems.

How to eliminate wrong answers

Option A is wrong because Maltego is a graphical link analysis tool used for open-source intelligence (OSINT) and relationship mapping, not for scanning the internet for exposed devices via banners. Option B is wrong because Nmap is a network scanning tool used to discover hosts and services on a local or remote network, but it does not maintain a global searchable index of internet-connected devices. Option D is wrong because Google is a general-purpose web search engine that indexes web pages and content, not device banners or metadata from non-HTTP services like industrial control protocols.

Practice this question →
10
MCQmedium

A security analyst receives an alert that an external IP address is sending fragmented packets to the company's web server on port 80. The analyst suspects the attacker is using Nmap with fragmentation. Which Nmap flag is being used to fragment the probe packets?

A.-sI
B.-D
C.--mtu
D.-f
AnswerD

The -f flag is the primary Nmap option used for IP fragmentation. When enabled, Nmap splits the IP header and the TCP/UDP header into several smaller IP packets, typically into 8-byte fragments. This technique can be highly effective in bypassing stateless firewalls or intrusion detection systems (IDS) that are not configured to reassemble fragmented packets before inspection, as they may only see the initial fragment and miss critical information in subsequent ones.

Why this answer

The -f flag in Nmap instructs the tool to fragment the probe packets into 8-byte or smaller fragments, making it harder for packet filters and intrusion detection systems to detect the scan. This matches the scenario where fragmented packets are sent to the web server on port 80, confirming that -f is the correct flag.

Exam trap

EC-Council often tests the distinction between -f (fragmentation) and --mtu (custom MTU size), leading candidates to mistakenly choose --mtu because they associate it with packet size changes, but only -f triggers fragmentation by default.

How to eliminate wrong answers

Option A is wrong because -sI is the Nmap flag for an Idle (zombie) scan, which spoofs the source IP address using a zombie host, not fragmenting packets. Option B is wrong because -D is used for decoy scans, which sends packets from multiple spoofed IP addresses to obscure the real source, not fragmenting the packets. Option C is wrong because --mtu sets a custom Maximum Transmission Unit size for packets, but it does not inherently fragment packets; fragmentation is achieved with -f, and --mtu is used to specify a different fragment size when combined with -f.

Practice this question →
11
MCQeasy

Which of the following is an example of passive OS fingerprinting?

A.Performing a TCP SYN scan
B.Nmap -O scan
C.Sending ICMP echo requests
D.Analyzing TTL values from captured packets
AnswerD

TTL can indicate OS type passively.

Why this answer

Passive OS fingerprinting involves analyzing captured network traffic without sending any packets to the target. Examining TTL (Time to Live) values from captured packets is a classic passive technique because different operating systems use default initial TTL values (e.g., Windows uses 128, Linux uses 64, Cisco IOS uses 255), and by observing the TTL in a received packet, you can infer the OS without actively probing the host.

Exam trap

EC-Council often tests the distinction between active and passive techniques, and the trap here is that candidates confuse 'analyzing captured data' (passive) with 'sending probes and analyzing responses' (active), leading them to pick options like Nmap -O scan or TCP SYN scan.

How to eliminate wrong answers

Option A is wrong because a TCP SYN scan actively sends SYN packets to the target and analyzes responses, which is an active fingerprinting technique. Option B is wrong because Nmap -O scan actively sends a series of crafted probes (e.g., TCP, UDP, ICMP) and analyzes responses to determine the OS, making it an active method. Option C is wrong because sending ICMP echo requests actively probes the target and analyzes replies (e.g., TTL, DF bit, ICMP error handling), which is active fingerprinting, not passive.

Practice this question →
12
MCQhard

An attacker uses an idle scan with Nmap to probe a target. This technique relies on a third-party host with a predictable IP ID sequence to infer port states. Which Nmap flag enables an idle scan?

A.-sS
B.-sI
C.-sA
D.-sT
AnswerB

The -sI flag correctly specifies an idle scan, which is a highly stealthy port scanning technique. This method leverages a "zombie" host's predictable IP ID sequence to infer open ports on a target without sending any packets directly from the attacker's machine to the target. By observing changes in the zombie's IP ID after it receives a forged packet from the target, the attacker can deduce the target's port status, effectively making the zombie perform the scan indirectly.

Why this answer

The idle scan (-sI) leverages a third-party host (zombie) with a predictable IP ID sequence to indirectly probe a target's ports. By spoofing the zombie's IP and observing changes in its IP ID counter, Nmap can infer whether a port is open, closed, or filtered without sending packets directly from the attacker's IP.

Exam trap

The trap here is that candidates often confuse -sI with -sS (SYN scan) because both are stealthy, but -sI specifically requires a zombie host and IP ID manipulation, not just half-open connections.

How to eliminate wrong answers

Option A (-sS) is wrong because it performs a TCP SYN stealth scan, which sends SYN packets directly from the attacker's IP and does not involve a zombie host or IP ID manipulation. Option C (-sA) is wrong because it performs a TCP ACK scan, which sends ACK packets to map firewall rules, not to conduct idle scanning. Option D (-sT) is wrong because it performs a TCP connect scan, which completes the full three-way handshake and is detectable, not an idle scan.

Practice this question →
13
MCQmedium

You need to perform a fast scan of all 65535 TCP ports on a target IP address. Which tool is specifically designed for high-speed scanning and can surpass Nmap's speed on large-scale networks?

A.Netcat
B.hping3
C.Nmap with -T5
D.Masscan
AnswerD

Masscan is explicitly designed as an internet-scale port scanner, capable of scanning the entire internet in under six minutes. Its unparalleled speed stems from its asynchronous, stateless design, which sends SYN packets at an extremely high rate without maintaining a full TCP connection state for each probe. By prioritizing raw packet transmission speed over traditional connection establishment, Masscan can efficiently scan all 65535 TCP ports on a target network significantly faster than other tools, making it ideal for rapid, broad-spectrum port discovery.

Why this answer

Masscan is the correct answer because it is specifically engineered for high-speed asynchronous scanning, capable of transmitting packets at rates exceeding 10 million packets per second, which allows it to scan all 65535 TCP ports on a target significantly faster than Nmap, even with the -T5 timing template. Unlike Nmap's synchronous or adaptive scanning, Masscan uses a custom TCP/IP stack and raw sockets to maximize throughput, making it the optimal tool for large-scale network reconnaissance.

Exam trap

The trap here is that candidates assume Nmap's -T5 timing template is the fastest possible scan, but they overlook that Masscan's asynchronous architecture is fundamentally different and designed for orders-of-magnitude higher throughput on large-scale networks.

How to eliminate wrong answers

Option A is wrong because Netcat is a general-purpose networking utility for reading/writing data across network connections, not a port scanner; it lacks the asynchronous, high-speed scanning engine required to efficiently scan all 65535 ports. Option B is wrong because hping3 is a packet crafting and testing tool that can perform port scanning, but it operates with a slower, more manual approach and is not designed for high-speed scanning of all ports on a large network. Option C is wrong because Nmap with -T5 uses the 'insane' timing template, which increases parallelism and reduces timeout intervals, but Nmap's architecture is still fundamentally synchronous and cannot match Masscan's raw packet rate for scanning all 65535 ports on a large-scale network.

Practice this question →
14
MCQeasy

A penetration tester wants to perform a stealthy TCP scan that does not complete the three-way handshake. Which Nmap flag should be used?

A.-sU
B.-sS
C.-sV
D.-sT
AnswerB

The -sS option initiates a SYN scan, often referred to as a 'stealth scan,' because it does not complete the full TCP three-way handshake. Nmap sends a SYN packet and, if a SYN/ACK is received, immediately responds with an RST packet, preventing the target system from logging a fully established connection. This technique allows the penetration tester to identify open TCP ports while minimizing the footprint and avoiding detection by many intrusion detection systems and application logs.

Why this answer

(-sS) is correct because it performs a SYN scan, which sends a TCP SYN packet and waits for a SYN-ACK response without completing the three-way handshake (i.e., it sends a RST instead of an ACK). This makes the scan stealthy as it avoids establishing a full TCP connection, reducing the chance of being logged by the target.

Exam trap

The trap here is that candidates often confuse -sS (SYN scan) with -sT (TCP connect scan), mistakenly thinking that -sT is stealthy because it uses TCP, but -sT actually completes the full handshake and is easily logged, while -sS is the true stealthy option.

How to eliminate wrong answers

Option A (-sU) is wrong because it performs a UDP scan, not a TCP scan, and UDP is connectionless, so it does not involve a three-way handshake at all. Option C (-sV) is wrong because it is used for version detection, which requires completing the three-way handshake to probe services, not for stealthy scanning. Option D (-sT) is wrong because it performs a full TCP connect scan, which completes the three-way handshake and is not stealthy, as it is more likely to be logged by the target system.

Practice this question →
15
Multi-Selectmedium

A security analyst wants to perform passive reconnaissance on a target domain. Which TWO of the following methods are considered passive? (Choose 2)

Select 2 answers
A.WHOIS lookup
B.Shodan search
C.Telnet banner grab
D.Ping sweep
E.Nmap SYN scan
AnswersA, B

A WHOIS lookup involves querying publicly accessible databases maintained by domain registrars and regional internet registries (RIRs) to retrieve information about a domain name or IP address. This process is entirely passive because the queries are directed at third-party databases, not the target's systems, ensuring no direct network traffic is sent to the target organization. Information gathered can include registrant contact details, registration and expiration dates, and nameservers.

Why this answer

WHOIS lookup is passive because it queries public registration databases (e.g., ARIN, RIPE) via the WHOIS protocol (RFC 3912) to retrieve domain ownership, registrar, and name server information without sending any packets to the target's own infrastructure. This data is publicly available and does not interact with the target's servers or network, making it a classic passive reconnaissance technique.

Exam trap

EC-Council often tests the distinction between passive and active reconnaissance by including tools like Shodan (which is passive) alongside active scanning tools like Nmap, leading candidates to mistakenly classify Shodan as active because it involves a search engine rather than direct network interaction.

Practice this question →
16
MCQeasy

Which of the following best describes the difference between active and passive reconnaissance?

A.Active reconnaissance is legal, while passive reconnaissance is not
B.Active reconnaissance involves direct interaction with the target, whereas passive reconnaissance does not
C.Passive reconnaissance uses tools like Nmap, while active reconnaissance uses Google dorks
D.Passive reconnaissance is used only during the exploitation phase
AnswerB

This is the core difference between the two approaches.

Why this answer

Active reconnaissance involves direct interaction with the target system, such as sending packets, probes, or connection requests (e.g., using Nmap scans, ping sweeps, or banner grabbing) that can be logged or detected by the target. Passive reconnaissance, in contrast, gathers information without engaging the target directly, relying on publicly available sources (e.g., WHOIS lookups, DNS records, social media, or search engines) and does not generate traffic that reaches the target's network. This distinction is fundamental in the CEH methodology because active techniques carry a higher risk of alerting the target, while passive techniques are stealthier and often used first to avoid detection.

Exam trap

EC-Council often tests the misconception that passive reconnaissance is 'safer' or 'always legal,' but the trap here is confusing the method of interaction (direct vs. indirect) with legality or tool assignment, leading candidates to pick Option A or C instead of the correct definition based on target interaction.

How to eliminate wrong answers

Option A is wrong because legality is not the defining difference; both active and passive reconnaissance can be legal or illegal depending on authorization and jurisdiction—active reconnaissance is not inherently legal, and passive reconnaissance is not inherently illegal. Option C is wrong because it reverses the typical tool usage: Nmap is a primary tool for active reconnaissance (sending packets to discover hosts and services), while Google dorks are a form of passive reconnaissance (searching publicly indexed data without direct interaction). Option D is wrong because passive reconnaissance is primarily used during the footprinting and reconnaissance phase, not the exploitation phase; exploitation occurs after reconnaissance and scanning are complete.

Practice this question →
17
MCQmedium

A penetration tester is scanning a target and receives the output: 'PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https'. Which Nmap flag was MOST likely used to obtain this output?

A.-sS
B.-O
C.-A
D.-sV
AnswerA

The -sS option performs a SYN scan, which is Nmap's default and most common scanning method. This "half-open" scan sends a SYN packet to each target port and, if a SYN/ACK is received, the port is marked as open before a full TCP connection is established. This efficient technique quickly identifies open ports and infers service names based on standard port assignments, making it ideal for initial reconnaissance without completing the three-way handshake.

Why this answer

The output shows open ports with their service names (ssh, http, https) but no version information. The -sS flag performs a SYN stealth scan, which by default probes common ports and uses the /etc/services file to map port numbers to service names. This matches the output format exactly, as -sS does not perform version detection or OS fingerprinting.

Exam trap

The trap here is that candidates often confuse the service name mapping (from -sS or default scan) with version detection (-sV), assuming that seeing 'ssh' or 'http' implies version probing occurred, when in fact Nmap simply maps the port number to a common service name from its database.

How to eliminate wrong answers

Option B is wrong because -O is used for OS detection, which would add OS fingerprinting details (e.g., 'OS: Linux 2.6.32') to the output, not just port states and service names. Option C is wrong because -A enables aggressive scanning (OS detection, version detection, script scanning, traceroute), which would produce far more verbose output including version strings and script results. Option D is wrong because -sV enables version detection, which would append version information (e.g., 'Apache httpd 2.4.41') to each service line, not just the service name from the port mapping.

Practice this question →
18
MCQhard

During a penetration test, you run the following Nmap command: nmap -sS -sV -O -A -T4 --script=default 10.0.0.1. The scan results show that port 443 is open and the service is 'Apache httpd 2.4.29'. However, banner grabbing with Netcat shows 'Apache/2.4.41 (Ubuntu)'. What is the MOST likely explanation for the discrepancy?

A.The server is using a reverse proxy that presents a different version to Nmap
B.Netcat banner grabbing is more reliable because it reads the actual server response
C.The discrepancy is due to Nmap's OS fingerprinting conflicting with version detection
D.Nmap is more accurate because it uses deep packet inspection
AnswerB

Netcat performs a direct banner grab by establishing a raw TCP connection to the target port and simply displaying the initial data sent by the service. This method directly reads the service's self-reported version string, which is typically the most authoritative source. In contrast, Nmap's -sV (service version detection) relies on a database of signatures and probes, which can sometimes be outdated, incomplete, or misinterpret non-standard banners, leading to discrepancies compared to the service's actual response.

Why this answer

Netcat performs a direct TCP connection to the service and reads the raw banner as sent by the application, which is the most immediate and unfiltered version information. Nmap's version detection (-sV) relies on probe-response matching against its signature database, which can be outdated or misinterpret the service if the server uses banner obfuscation or if the Nmap database does not have an exact match for the newer version. In this case, Netcat reveals the actual server version (2.4.41), while Nmap's database may only have a signature for 2.4.29, leading to a false lower version.

Exam trap

The trap here is that candidates assume Nmap is always more accurate because it is a sophisticated scanning tool, but in version detection, a direct banner grab with Netcat is often more reliable when the service banner is not suppressed.

How to eliminate wrong answers

Option A is wrong because a reverse proxy would typically present the same version to both Nmap and Netcat, or could mask the backend version entirely; it would not cause Nmap to report a lower version than the actual banner. Option C is wrong because OS fingerprinting (-O) is a separate function that does not interfere with version detection; the discrepancy is between two version detection methods, not OS fingerprinting. Option D is wrong because Nmap's version detection does not use deep packet inspection; it sends specific probes and matches responses to a signature database, which can be less accurate than a direct banner grab if the database is outdated or the service responds differently to probes.

Practice this question →
19
MCQhard

A security analyst runs a vulnerability scan with Nessus and receives a report indicating that multiple hosts have the 'MS17-010' vulnerability. What is the MOST likely impact of this vulnerability if exploited?

A.Remote code execution on Windows systems
B.SQL injection
C.Cross-site scripting
D.DNS cache poisoning
AnswerA

Nessus scans are highly effective at identifying critical operating system vulnerabilities, such as the MS17-010 vulnerability, famously known as EternalBlue. This flaw in the Server Message Block (SMB) protocol allows unauthenticated remote code execution on vulnerable Windows systems. A successful scan would flag this specific vulnerability, indicating a severe risk of compromise and potential for widespread malware infection like WannaCry or NotPetya, making it the most relevant finding.

Why this answer

MS17-010 is a critical remote code execution vulnerability in the Microsoft Server Message Block (SMB) protocol. Exploitation allows an unauthenticated attacker to send specially crafted packets to an SMB server, enabling arbitrary code execution with system privileges. This is the same vulnerability leveraged by the EternalBlue exploit used in the WannaCry ransomware attacks.

Exam trap

The trap here is that candidates may confuse MS17-010 with a general network vulnerability, but the CEH exam specifically tests that it is a remote code execution flaw in Windows SMB, not a web or DNS attack.

How to eliminate wrong answers

Option B is wrong because SQL injection targets database query layers (e.g., SQL statements) and is unrelated to SMB protocol vulnerabilities. Option C is wrong because cross-site scripting (XSS) exploits web application input validation to inject client-side scripts, not SMB remote code execution. Option D is wrong because DNS cache poising manipulates DNS resolver caches via forged responses, which is a network-layer attack distinct from the SMB-based MS17-010 flaw.

Practice this question →
20
Multi-Selecteasy

Which TWO of the following are passive reconnaissance techniques? (Select 2)

Select 2 answers
A.Performing a WHOIS lookup
B.Running an Nmap version scan
C.Performing a ping sweep
D.Using Shodan to find exposed devices
E.Banner grabbing with Netcat
AnswersA, D

Performing a WHOIS lookup is a classic passive reconnaissance technique because it queries publicly available databases maintained by domain registrars and registries. This action retrieves information such as domain owner, administrative contacts, nameservers, and registration dates without sending any packets directly to the target's servers or network. The data is simply pulled from a third-party repository, making it entirely non-intrusive and undetectable by the target.

Why this answer

A WHOIS lookup queries public databases (e.g., ARIN, RIPE) to retrieve domain registration details such as registrar, creation date, and name server records. This is passive because it relies on publicly available information without sending any packets to the target network or interacting with its live systems.

Exam trap

EC-Council often tests the distinction between passive and active reconnaissance by making candidates confuse techniques that use public databases (passive) with those that send packets to the target (active); the trap here is that banner grabbing with Netcat feels passive because it only reads a response, but it still requires initiating a TCP connection to the target.

Practice this question →
21
Multi-Selectmedium

Which TWO of the following Nmap scans are considered 'stealth' scans that do not complete a full TCP three-way handshake?

Select 2 answers
A.FIN scan (-sF)
B.TCP connect scan (-sT)
C.UDP scan (-sU)
D.SYN scan (-sS)
E.ACK scan (-sA)
AnswersA, D

The FIN scan (-sF) is considered stealthy because it sends only a FIN packet to the target port without initiating a full TCP three-way handshake. If the port is open, it typically ignores the packet, while a closed port will respond with an RST/ACK. This technique often bypasses stateless firewalls and avoids logging on the target system, as no connection is ever established, making it less detectable.

Why this answer

A FIN scan (-sF) sends a TCP packet with only the FIN flag set. According to RFC 793, if the port is closed, the target responds with an RST packet; if open, the packet is ignored. This avoids completing a full TCP three-way handshake, making it a stealth scan.

Exam trap

The trap here is that candidates often confuse 'stealth' with 'invisible' and incorrectly assume that any scan not completing a handshake qualifies, but the CEH defines stealth scans specifically as those that avoid the full three-way handshake (SYN, FIN, Xmas, Null) and are designed to evade detection, not just any non-handshake scan like ACK scan.

Practice this question →
22
Multi-Selectmedium

Which TWO of the following Nmap flags are used for evasion of IDS/IPS? (Choose two.)

Select 2 answers
A.-sV
B.-O
C.-D
D.-f
E.-sT
AnswersC, D

The -D flag enables decoy scanning, an effective evasion technique where Nmap sends scan packets from multiple spoofed source IP addresses in addition to the attacker's real IP. By interspersing legitimate scan packets with numerous fake ones, this method aims to confuse Intrusion Detection Systems (IDS) and obscure the true origin of the scan. This makes it significantly harder for security analysts to pinpoint the actual attacker's machine amidst a flood of seemingly disparate scan attempts, thus providing a layer of anonymity.

Why this answer

(-D) is correct because the Nmap decoy scan flag allows you to spoof multiple source IP addresses, making it difficult for IDS/IPS to distinguish the real scanning host from decoys. Option D (-f) is correct because fragmenting packets (e.g., using -f to split TCP headers into 8-byte fragments) evades signature-based detection by bypassing pattern-matching rules that expect complete packet headers.

Exam trap

EC-Council often tests the misconception that -sV or -O are evasion techniques because they are 'stealthy' in some contexts, but the CEH exam specifically requires knowing that decoys (-D) and fragmentation (-f) are the standard Nmap evasion flags.

Practice this question →
23
MCQmedium

An analyst executes 'nmap -sU -p 161,162 10.0.0.1'. What is the primary purpose of this scan?

A.Detect TCP services on the target
B.Enumerate all open ports on the target
C.Discover SNMP services running on the target
D.Perform a SYN flood attack
AnswerC

The command `nmap -sU -p 161,162` specifically instructs Nmap to perform a UDP scan on ports 161 and 162. UDP port 161 is the well-known port for the Simple Network Management Protocol (SNMP) agent, used for management queries, while UDP port 162 is designated for SNMP trap messages, which are asynchronous notifications. Therefore, this scan is precisely configured to identify the presence and responsiveness of SNMP services and their associated trap listeners on the target.

Why this answer

The `-sU` flag instructs Nmap to perform a UDP scan, and the `-p 161,162` targets the default SNMP ports (UDP 161 for SNMP queries, UDP 162 for SNMP traps). This combination is specifically designed to discover SNMP services running on the target host, as SNMP operates exclusively over UDP. Option C is correct because the command's primary purpose is to probe for SNMP services.

Exam trap

The trap here is that candidates often confuse `-sU` with TCP scans or assume the command scans all ports, but CEH specifically tests the understanding that `-sU` with `-p 161,162` targets SNMP over UDP, not general port enumeration or attacks.

How to eliminate wrong answers

Option A is wrong because `-sU` specifies a UDP scan, not a TCP scan; TCP services are detected using `-sT` or `-sS`, not `-sU`. Option B is wrong because the command only scans ports 161 and 162, not all ports; enumerating all open ports would require a broader port range (e.g., `-p-`) or a different scan type. Option D is wrong because a SYN flood attack is a denial-of-service technique using TCP SYN packets, whereas this is a reconnaissance scan using UDP probes; Nmap does not perform attacks by default.

Practice this question →
24
MCQeasy

During a security assessment, a tester uses `nmap -sU 192.168.1.1`. What type of scan does this command perform?

A.UDP scan
B.TCP SYN scan
C.Ping sweep
D.OS fingerprinting
AnswerA

The `nmap -sU` command explicitly instructs Nmap to perform a UDP scan, which is the correct interpretation of the provided syntax. This method sends UDP packets to target ports and analyzes the responses (or lack thereof) to determine if a port is open, closed, or filtered. Unlike TCP, UDP is connectionless, making port state determination more challenging and often slower, as open ports may not send a response, while closed ports typically return an ICMP Port Unreachable message.

Why this answer

The `-sU` flag in Nmap explicitly instructs the tool to perform a UDP scan. This sends UDP packets to the target ports and analyzes responses (or lack thereof) to determine if a UDP port is open, closed, or filtered. Unlike TCP, UDP is connectionless, so the scan relies on ICMP unreachable messages or lack of response to infer port status.

Exam trap

The trap here is that candidates confuse the `-sU` flag with a TCP SYN scan (`-sS`) or assume it performs a general host discovery, but the question specifically tests knowledge of Nmap's scan type flags.

How to eliminate wrong answers

Option B is wrong because TCP SYN scan uses the `-sS` flag, not `-sU`, and relies on the TCP three-way handshake (sending a SYN packet) to determine port states. Option C is wrong because a ping sweep typically uses ICMP echo requests (or TCP/UDP probes to multiple hosts) to discover live hosts, not a single target with UDP probes; the command `nmap -sn` is used for ping sweeps. Option D is wrong because OS fingerprinting is performed with options like `-O` or `-A`, which analyze TCP/IP stack behavior, not a simple UDP scan.

Practice this question →
25
MCQmedium

An incident responder analyzes logs and finds repeated failed zone transfer attempts from an external IP. The zone transfer requests are targeting the domain example.com. Which DNS record type, if misconfigured, would allow this attack to succeed?

A.NS records
B.AXFR
C.MX records
D.SOA records
AnswerB

AXFR is the DNS query type for zone transfers. Allowing AXFR from unauthorized hosts is a misconfiguration.

Why this answer

B is correct because AXFR (Asynchronous Full Transfer) is the DNS zone transfer protocol that, if misconfigured (i.e., allowing unrestricted AXFR queries from any IP), permits an external attacker to request and receive the entire DNS zone file for example.com. The repeated failed attempts indicate the attacker is probing for an open AXFR service, which would succeed if the DNS server is configured to allow zone transfers to any host without restriction.

Exam trap

The trap here is that candidates confuse the DNS record type (e.g., NS, SOA) with the protocol or query type (AXFR) used to perform the zone transfer, leading them to select a record type instead of recognizing AXFR as the specific misconfiguration that enables the attack.

How to eliminate wrong answers

Option A is wrong because NS records specify the authoritative name servers for a domain, not the mechanism for transferring zone data; misconfigured NS records could lead to delegation issues but do not directly allow zone transfer attacks. Option C is wrong because MX records define mail exchange servers for email routing and have no role in DNS zone transfers; they are irrelevant to the attack described. Option D is wrong because SOA records contain administrative metadata about the zone (e.g., serial number, refresh interval) but do not control or enable zone transfer requests; misconfigured SOA records might affect zone replication timing but not allow external AXFR queries.

Practice this question →
26
MCQmedium

A penetration tester uses the following Google dork: site:example.com filetype:pdf inurl:confidential. What is the MOST likely goal of this search?

A.Retrieve all PDF files from example.com regardless of content
B.Identify all web pages on example.com that link to PDF files
C.Find PDF files on example.com that have 'confidential' in their filename or path
D.Discover PDF files that contain the word 'confidential' on example.com
AnswerC

This option accurately describes the dork's function. The 'inurl:confidential' operator specifically targets URLs that contain the string "confidential," which encompasses both the directory path and the filename components of a URL. When combined with 'filetype:pdf' and 'site:example.com', the dork precisely identifies PDF documents on the specified domain where "confidential" appears within their web address.

Why this answer

The Google dork `site:example.com filetype:pdf inurl:confidential` combines the `site` operator to restrict results to example.com, `filetype:pdf` to filter for PDF files, and `inurl:confidential` to require that the URL or path contains the word 'confidential'. This targets PDF files whose filename or directory path includes 'confidential', making option C correct. The `inurl` operator matches the URL string, not the file content, so it does not search within the PDF text.

Exam trap

The trap here is confusing `inurl` (which searches the URL string) with `intext` or content-based search, leading candidates to incorrectly assume the dork finds PDFs containing the word 'confidential' inside the document.

How to eliminate wrong answers

Option A is wrong because the dork includes `inurl:confidential`, which narrows results to PDFs with 'confidential' in the URL, not all PDFs. Option B is wrong because the dork retrieves PDF files directly, not web pages that link to PDFs; `filetype:pdf` returns the PDF file itself. Option D is wrong because `inurl` searches the URL string, not the content of the PDF; to search within file content, one would use `intext` or `filetype:pdf` combined with a content search term like `"confidential"` without `inurl`.

Practice this question →
27
MCQeasy

Which of the following Google dorks would an attacker MOST likely use to find login pages of web applications that are publicly accessible?

A.intitle:login
B.inurl:robots.txt
C.filetype:pdf
D.cache:example.com
AnswerA

The `intitle:login` Google dork is a highly effective reconnaissance tool for attackers, specifically designed to locate web pages where the HTML `<title>` tag contains the word "login". This operator is crucial for identifying potential authentication interfaces, administrative panels, or other sensitive entry points on target systems. By focusing the search on page titles, it efficiently filters out irrelevant results, allowing attackers to quickly pinpoint web pages that likely require user credentials. This precision makes it an invaluable technique for initial information gathering and identifying potential attack vectors.

Why this answer

The Google dork 'intitle:login' is most effective for finding login pages because it searches for the word 'login' in the HTML title tag of web pages. Attackers use this to quickly identify publicly accessible authentication portals, which are common entry points for brute-force or credential-stuffing attacks. This dork directly targets the page title, a standard HTML element that often contains the word 'login' on authentication pages.

Exam trap

EC-Council often tests the distinction between operators that find specific page content (like 'intitle:') versus those that find file types or cached data, leading candidates to confuse 'inurl:robots.txt' (which finds a specific file) with finding login pages.

How to eliminate wrong answers

Option B is wrong because 'inurl:robots.txt' is used to find the robots.txt file, which discloses directories that the site owner wants to hide from search engines, not login pages. Option C is wrong because 'filetype:pdf' restricts results to PDF files, which are unlikely to be login pages (login pages are typically HTML). Option D is wrong because 'cache:example.com' shows the cached version of a specific domain, not a search for login pages across multiple sites.

Practice this question →
28
MCQmedium

Which of the following tools would be BEST to use for identifying all live hosts in a large IP range (e.g., 10.0.0.0/8) quickly?

A.Masscan
B.OpenVAS
C.Nmap with -sL flag
D.hping3
AnswerA

Masscan is exceptionally well-suited for rapid host discovery across vast IP ranges due to its asynchronous, custom-built TCP SYN scanner. It can transmit millions of packets per second, bypassing the operating system's network stack by using raw sockets to achieve unparalleled scanning speed. This makes it the optimal choice for identifying live hosts quickly over large networks or the entire internet.

Why this answer

Masscan is the best choice because it is designed for high-speed scanning across large IP ranges, capable of transmitting packets at rates exceeding 10 million packets per second. It uses asynchronous transmission and raw sockets to quickly identify live hosts by sending SYN probes and analyzing responses, making it ideal for scanning a /8 subnet (16.7 million addresses) in minutes.

Exam trap

EC-Council often tests the distinction between scanning speed and functionality, where candidates mistakenly choose Nmap (a versatile tool) for large-range host discovery without recognizing that its default scanning modes are too slow for a /8 subnet, whereas Masscan is purpose-built for speed.

How to eliminate wrong answers

Option B (OpenVAS) is wrong because it is a vulnerability scanner that performs in-depth analysis on identified hosts, not a tool for rapid host discovery across large ranges; its scanning speed is too slow for a /8 subnet. Option C (Nmap with -sL flag) is wrong because the -sL flag performs a list scan that only resolves DNS names without sending any packets, so it cannot identify live hosts. Option D (hping3) is wrong because it is a packet crafting tool used for targeted testing and firewall auditing, not designed for high-speed scanning of massive IP ranges; its sequential packet transmission makes it impractical for a /8 subnet.

Practice this question →
29
MCQeasy

During a penetration test, the tester wants to discover all subdomains of a target domain using an OSINT technique. Which tool is specifically designed for subdomain enumeration via search engines and public records?

A.theHarvester
B.Maltego
C.Shodan
D.dnsrecon
AnswerA

theHarvester is designed to gather emails, subdomains, and other information from public sources.

Why this answer

theHarvester is specifically designed to perform OSINT-based subdomain enumeration by querying search engines (e.g., Google, Bing) and public data sources (e.g., PGP key servers, DNSDumpster). It collects email addresses, subdomains, IPs, and virtual hosts without direct interaction with the target's infrastructure, making it ideal for passive reconnaissance.

Exam trap

EC-Council often tests the distinction between passive OSINT tools (theHarvester) and active reconnaissance tools (dnsrecon), so candidates mistakenly choose dnsrecon because it is a DNS tool, but the question explicitly requires an OSINT technique using search engines and public records.

How to eliminate wrong answers

Option B (Maltego) is wrong because it is a general-purpose OSINT and link-analysis platform that requires transforms (some of which are paid) and is not solely focused on subdomain enumeration via search engines; it is overkill for this specific task. Option C (Shodan) is wrong because it is a search engine for internet-connected devices and services (e.g., IoT, servers), not for enumerating subdomains of a target domain via search engines or public records. Option D (dnsrecon) is wrong because it performs active DNS reconnaissance (e.g., zone transfers, brute-force subdomain discovery) and is not an OSINT technique that relies on search engines and public records.

Practice this question →
30
MCQhard

A penetration tester runs `nmap -sI 192.168.1.10 -p 80 10.0.0.1` and receives output indicating port 80 is open. The scan uses a zombie host. Which type of scan is this?

A.Idle scan
B.SYN scan
C.Decoy scan
D.Fragmentation scan
AnswerA

The Nmap idle scan (-sI) is a highly stealthy technique that allows a penetration tester to scan a target without sending any packets directly from their own IP address. Instead, it leverages a "zombie" host's IP ID sequence to infer open ports on the target. By observing changes in the zombie's IP ID, the scanner can determine if the target responded to a forged packet sent from the zombie, thus achieving a truly blind scan, matching the 'si' flag in the command.

Why this answer

The `-sI` flag in Nmap specifies an idle scan, which uses a zombie host (192.168.1.10) to probe the target (10.0.0.1). By observing changes in the zombie's IP ID sequence, the attacker can infer whether a port on the target is open or closed without revealing their own IP address. The output indicating port 80 is open confirms the scan type as an idle scan.

Exam trap

The trap here is that candidates confuse the `-sI` flag with decoy scans (`-D`) because both involve spoofing, but idle scans uniquely require a zombie host and IP ID analysis, not just multiple decoy IPs.

How to eliminate wrong answers

Option B is wrong because a SYN scan uses the `-sS` flag, not `-sI`, and does not involve a zombie host; it sends raw SYN packets directly from the attacker's IP. Option C is wrong because a decoy scan uses the `-D` flag to spoof multiple source IPs to obscure the real scanner, but it does not rely on a zombie host's IP ID sequence. Option D is wrong because a fragmentation scan uses the `-f` flag to split packets into smaller fragments to evade detection, not to leverage a zombie host for stealth.

Practice this question →
31
MCQeasy

During a passive reconnaissance phase, a penetration tester uses a tool to gather email addresses, subdomains, and employee names associated with a target domain without directly interacting with the target's systems. Which tool is BEST suited for this purpose?

A.theHarvester
B.Nmap
C.Netcat
D.Wireshark
AnswerA

theHarvester is a passive OSINT tool that collects emails, subdomains, IPs, and names from public sources like Google, Bing, and LinkedIn.

Why this answer

theHarvester is specifically designed for passive reconnaissance by querying public sources such as search engines (Google, Bing), PGP key servers, and the Shodan API to collect email addresses, subdomains, and employee names without sending any packets directly to the target's infrastructure. This aligns perfectly with the requirement of gathering OSINT data without direct interaction.

Exam trap

The trap here is that candidates often confuse passive reconnaissance with tools that can be used passively in some contexts (like Wireshark for sniffing), but the question specifically requires gathering email addresses, subdomains, and employee names from public sources, which only theHarvester is designed to do.

How to eliminate wrong answers

Option B (Nmap) is wrong because it actively sends crafted packets to target hosts to discover open ports and services, which constitutes active reconnaissance and would generate logs on the target's systems. Option C (Netcat) is wrong because it is a network utility for reading/writing data across TCP/UDP connections, used for banner grabbing or port scanning, both of which involve direct interaction with the target. Option D (Wireshark) is wrong because it is a packet analyzer that captures and inspects network traffic already on the wire, requiring either existing traffic from the target or active sniffing, and does not perform passive OSINT collection from public sources.

Practice this question →
32
MCQeasy

Which of the following tools is PRIMARILY used for passive OSINT gathering and can query multiple search engines, social media platforms, and public databases to collect information about a target?

A.Nmap
B.Wireshark
C.Maltego
D.theHarvester
AnswerC

Maltego is a comprehensive graphical link analysis tool specifically engineered for open-source intelligence (OSINT) and forensic investigations. It excels at aggregating data from diverse public sources, including DNS records, social media, and WHOIS information, to uncover relationships between entities. Its unique strength lies in visualizing these connections through interactive graphs, enabling analysts to identify patterns and build a detailed profile of a target without direct interaction.

Why this answer

Maltego is primarily used for passive OSINT gathering because it leverages open-source intelligence feeds, search engines, social media platforms, and public databases to collect and correlate information about a target without directly interacting with the target's systems. Its transform-based architecture allows it to query multiple data sources simultaneously, making it the correct choice for passive reconnaissance.

Exam trap

The trap here is that candidates often confuse theHarvester with Maltego because both are OSINT tools, but theHarvester is more specialized for email and subdomain harvesting, while Maltego is the broader platform for multi-source passive intelligence gathering and visualization.

How to eliminate wrong answers

Option A is wrong because Nmap is an active reconnaissance tool that sends crafted packets to target hosts to discover open ports, services, and operating systems, which generates network traffic and can be detected. Option B is wrong because Wireshark is a network protocol analyzer used for capturing and inspecting live or recorded traffic, not for querying search engines or public databases for OSINT. Option D is wrong because theHarvester is indeed an OSINT tool, but it is primarily focused on email addresses, subdomains, and names from search engines and PGP key servers, not the broad multi-source correlation and visualization that Maltego provides for passive OSINT gathering.

Practice this question →
33
MCQeasy

During a penetration test, you need to identify all live hosts on a target network without being detected by intrusion detection systems. Which Nmap flag would BEST achieve this?

A.-O (OS fingerprinting)
B.-sn (ping sweep)
C.-sS (SYN scan)
D.-sV (version detection)
AnswerB

The -sn (no port scan) flag, also known as a ping sweep, is specifically designed for host discovery by sending ICMP echo requests, TCP SYN packets to common ports, or ARP requests on local networks. It efficiently identifies live hosts with minimal network overhead and without initiating any full port scans, thereby significantly reducing the likelihood of detection by network security monitoring tools.

Why this answer

The -sn flag (ping sweep) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default to determine if a host is alive. This is the best choice for stealthy host discovery because it does not complete a full TCP handshake or send application-layer probes, minimizing the chance of triggering IDS signatures that look for port scans or OS fingerprinting.

Exam trap

The trap here is that candidates often confuse -sn (ping sweep) with -sS (SYN scan) because both involve TCP packets, but -sn is purely for host discovery without port scanning, whereas -sS is a port scanning technique that is much more intrusive and detectable.

How to eliminate wrong answers

Option A is wrong because -O (OS fingerprinting) sends a series of crafted TCP packets to analyze responses for OS detection, which is highly detectable by IDS due to the unusual packet combinations and is not designed for simple host discovery. Option C is wrong because -sS (SYN scan) sends TCP SYN packets to specific ports to identify open ports, which is a port scanning technique that can trigger IDS alerts for half-open connections and is not optimized for stealthy live host detection. Option D is wrong because -sV (version detection) initiates full TCP connections and sends probe strings to identify service versions, which is noisy and easily detected by IDS, and is intended for service enumeration, not host discovery.

Practice this question →
34
MCQhard

A security analyst runs the Nmap command: nmap -sI 192.168.1.50 -p 80 10.0.0.1. The scan completes, but the target shows no open ports. What is the MOST likely explanation?

A.The analyst used the wrong port number
B.The target has a firewall blocking the decoy packets
C.The target host is offline
D.The zombie host is not truly idle, causing false results
AnswerD

The Nmap idle scan (`-sI`) fundamentally relies on the zombie host's IP ID sequence number incrementing predictably by one for each packet it sends. The attacker sends spoofed SYN packets to the target, appearing to originate from the zombie. If the zombie is not truly idle and sends its own packets for other reasons, its IP ID sequence will increment unpredictably, making it impossible for the attacker to discern whether an IP ID increment was due to the target's response or the zombie's independent activity, thus leading to unreliable or false results.

Why this answer

The -sI flag in Nmap performs an idle scan, which relies on a zombie host (192.168.1.50) with a globally predictable IP ID sequence to probe the target. If the zombie host is not truly idle—meaning it is sending or receiving other traffic during the scan—its IP ID values will increment unpredictably, corrupting the side-channel analysis and causing Nmap to report all ports as filtered or closed. This is the most likely reason for the false 'no open ports' result.

Exam trap

The trap here is that candidates often assume a firewall or offline target is the cause, but the idle scan's success hinges entirely on the zombie's idle state, not on target-side filtering or host availability.

How to eliminate wrong answers

Option A is wrong because the -p 80 flag explicitly targets port 80, and the scan completed without error, so the port number is not the issue. Option B is wrong because a firewall blocking decoy packets would not affect an idle scan; idle scans use the zombie's IP, not decoys, and firewall rules on the target would block the zombie's packets, not the analyst's. Option C is wrong because if the target host were offline, Nmap would typically report 'Host seems down' or time out, not complete the scan and show 'no open ports'.

Practice this question →
35
MCQhard

A penetration tester observes that an Nmap SYN scan shows all 1000 TCP ports as open. The tester suspects the target is using a security appliance that responds with SYN-ACK to all connection attempts, regardless of the actual port state. Which type of Nmap scan would be MOST effective in determining the true state of the ports?

A.UDP scan (-sU)
B.Ping sweep (-sn)
C.TCP connect scan (-sT)
D.Idle scan (-sI)
AnswerC

The TCP connect scan (-sT) performs a full three-way handshake (SYN, SYN-ACK, ACK) with the target port, relying on the operating system's native `connect()` system call. If a port is genuinely open, the handshake completes. If a spoofed SYN-ACK is received, the scanner's subsequent ACK will likely be ignored by the true target, or the target will send a RST if the port is closed. This full interaction allows the scanner to observe the actual target's response to a completed connection attempt, thereby reliably determining the port's true state even if initial SYN-ACKs were manipulated.

Why this answer

A TCP connect scan (-sT) completes the full three-way handshake, which forces the target to respond with a RST if the port is actually closed, even if a security appliance initially sends SYN-ACK to all ports. This distinguishes between ports that are truly open (where the handshake completes) and those that are falsely reported as open by the appliance (where the handshake fails or a RST is received).

Exam trap

The trap here is that candidates assume a SYN scan (-sS) is always superior due to stealth, but they overlook that a security appliance can spoof SYN-ACKs, making the full handshake of -sT necessary to bypass the deception.

How to eliminate wrong answers

Option A is wrong because a UDP scan (-sU) targets UDP ports, not TCP ports, and cannot determine the true state of TCP ports; it also suffers from false positives due to ICMP unreachable responses. Option B is wrong because a ping sweep (-sn) only checks host availability via ICMP or TCP pings and does not perform any port-level scanning to determine port states. Option D is wrong because an idle scan (-sI) relies on a zombie host with predictable IP IDs and is designed for stealth, not for bypassing SYN-ACK spoofing; it would still receive SYN-ACKs from the appliance and cannot differentiate real open ports from spoofed responses.

Practice this question →
36
MCQeasy

Which of the following is a passive OS fingerprinting technique that does NOT send any packets to the target?

A.Sending TCP SYN packets and analyzing responses
B.Analyzing TTL and window size from captured packets
C.Performing a NULL scan
D.Using Nmap -O flag
AnswerB

Analyzing the Time-To-Live (TTL) and TCP window size fields from packets already captured from network traffic is a classic passive OS fingerprinting method. This technique does not involve sending any new packets to the target system; instead, it infers the operating system by examining the initial TTL values (which decrement per hop) and the advertised TCP window sizes, both of which often have distinct default values across different OS implementations. By observing these characteristics in legitimate, ongoing communications, an attacker can identify the OS without direct interaction.

Why this answer

Passive OS fingerprinting involves observing network traffic without sending any packets to the target. Analyzing the Time-to-Live (TTL) and TCP window size from captured packets is a classic passive technique because these values are OS-specific defaults (e.g., Linux often uses TTL 64 and window size 5840, while Windows uses TTL 128 and window size 65535). Since no packets are sent to the target, this method is entirely passive and undetectable.

Exam trap

The trap here is that candidates often confuse passive fingerprinting with active techniques like banner grabbing or Nmap scans, assuming that any packet capture analysis is passive, but the key distinction is whether any packets are sent to the target.

How to eliminate wrong answers

Option A is wrong because sending TCP SYN packets and analyzing responses is an active fingerprinting technique, as it involves transmitting packets to the target. Option C is wrong because performing a NULL scan sends TCP packets with no flags set to the target, making it an active reconnaissance method. Option D is wrong because using Nmap with the -O flag sends a series of probes (e.g., TCP SYN, ICMP) to the target to determine the OS, which is an active fingerprinting approach.

Practice this question →
37
Multi-Selecthard

During a penetration test, you need to enumerate all DNS records for example.com using a zone transfer. Which TWO tools can be used to attempt this?

Select 2 answers
A.dnsenum
B.dig
C.dnsrecon
D.theHarvester
E.nslookup
AnswersA, C

dnsenum is a powerful and comprehensive tool specifically designed for DNS enumeration during penetration tests. It automates various techniques, including attempting AXFR (Asynchronous Zone Transfer) requests, brute-forcing subdomains from a wordlist, performing reverse lookups on IP ranges, and querying for multiple DNS record types like MX, NS, and A records. This multi-faceted approach allows it to gather extensive information about a target's DNS infrastructure efficiently.

Why this answer

Options A (dnsenum) and C (dnsrecon) are both specialized DNS enumeration tools that can attempt a full zone transfer (AXFR query) to retrieve all DNS records for a domain. dnsenum automates zone transfer attempts against multiple nameservers, while dnsrecon includes similar functionality. Although tools like dig and nslookup can also perform manual zone transfers, the question specifically asks for tools designed for enumeration, making dnsenum and dnsrecon the correct choices.

Exam trap

The trap here is that candidates confuse tools that can manually perform a zone transfer (like dig or nslookup) with dedicated enumeration tools that automate the process across multiple nameservers, leading them to select dig or nslookup instead of dnsenum and dnsrecon.

Practice this question →
38
MCQhard

You are performing a penetration test and need to quickly scan a large IP range (e.g., 10.0.0.0/8) for open ports 80 and 443. Which tool is BEST suited for this high-speed scanning task?

A.OpenVAS
B.hping3
C.Nmap
D.Masscan
AnswerD

Masscan is purpose-built for ultra-fast port scanning, capable of scanning the entire internet in minutes by employing an asynchronous, stateless design that sends packets at an extremely high rate. It achieves this speed by operating like a network driver, transmitting packets directly and listening for responses, making it exceptionally efficient for quickly discovering open ports across massive IP address ranges, which is crucial for rapid reconnaissance in large-scale penetration tests.

Why this answer

Masscan is the best tool for this task because it is designed specifically for high-speed port scanning, capable of transmitting packets at rates exceeding 10 million packets per second, which is necessary to scan a /8 subnet (over 16 million IPs) for ports 80 and 443 in a reasonable timeframe. Unlike Nmap, which optimizes for accuracy and service detection, Masscan uses asynchronous raw socket transmission and can be tuned with the --rate parameter to maximize throughput, making it ideal for large-scale reconnaissance.

Exam trap

The trap here is that candidates often choose Nmap because it is the most familiar and versatile scanning tool, but the question specifically emphasizes 'high-speed' scanning of a massive IP range, which is Masscan's unique strength due to its asynchronous raw packet design and ability to achieve millions of packets per second.

How to eliminate wrong answers

Option A is wrong because OpenVAS is a vulnerability scanner that performs deep, slow assessments with authenticated checks and plugin-based testing, not a high-speed port scanner, and would take an impractical amount of time on a /8 range. Option B is wrong because hping3 is a packet crafting tool used for custom TCP/IP testing, firewall auditing, and DoS simulation, but it lacks the asynchronous scanning engine and rate optimization needed to scan millions of IPs quickly. Option C is wrong because while Nmap can scan large ranges with its -T5 timing template, its synchronous scanning model and service/version detection overhead make it significantly slower than Masscan for pure port discovery at scale, and it is not optimized for the extreme packet rates required for a /8 subnet.

Practice this question →
39
Multi-Selecthard

A security analyst is conducting passive reconnaissance on a target organization. Which THREE of the following are examples of passive reconnaissance techniques? (Select 3)

Select 3 answers
A.Performing a WHOIS lookup on the target's domain
B.Querying a public DNS resolver cache for the target's mail server records
C.Running an Nmap SYN scan against the target's web server
D.Banner grabbing with Netcat on port 80
E.Using Google dork queries to find exposed documents
AnswersA, B, E

Performing a WHOIS lookup involves querying publicly accessible databases maintained by domain registrars and registries. This action retrieves domain registration details such as registrant contact information, administrative contacts, technical contacts, and registration dates without sending any packets directly to the target's infrastructure. Since the interaction is solely with a third-party public database, it constitutes passive reconnaissance.

Why this answer

WHOIS queries are a classic passive reconnaissance technique because they retrieve publicly registered domain ownership data from WHOIS databases (e.g., registrar, creation date, name servers) without sending any packets directly to the target's infrastructure. This information is stored by third-party registries and is accessible via standard WHOIS protocol (RFC 3912) or web-based lookup tools, making it completely non-intrusive.

Exam trap

EC-Council often tests the distinction between passive and active reconnaissance by including techniques that appear passive (like banner grabbing) but actually involve direct interaction with the target's services, leading candidates to mistakenly classify them as passive.

Practice this question →
40
Multi-Selecteasy

Which TWO of the following are examples of active reconnaissance? (Select 2)

Select 2 answers
A.Performing a WHOIS lookup
B.Analyzing public social media profiles for employee information
C.Conducting an Nmap SYN scan on the target network
D.Running a Google dork search for sensitive files
E.Using netcat to retrieve a banner from a web server
AnswersC, E

Nmap sends packets directly to the target, making it active.

Why this answer

An Nmap SYN scan sends raw SYN packets to target ports and analyzes the responses (SYN-ACK for open, RST for closed). This actively probes the target network, generating traffic that can be detected by intrusion detection systems, which is the defining characteristic of active reconnaissance.

Exam trap

The trap here is that candidates often confuse 'publicly available information' (passive) with 'direct interaction' (active), leading them to incorrectly select WHOIS lookups or Google dork searches as active reconnaissance.

Practice this question →
41
MCQeasy

During a security assessment, a tester uses Maltego to gather information about a target organization. Which type of reconnaissance is being performed?

A.Passive reconnaissance
B.Active reconnaissance
C.Vulnerability scanning
D.Social engineering
AnswerA

This is correct because Maltego primarily functions as an Open Source Intelligence (OSINT) gathering tool. It aggregates publicly available information from various internet sources, such as DNS records, WHOIS databases, social media profiles, and search engines, without initiating any direct network connections or probes to the target's infrastructure. This method allows testers to build a comprehensive organizational footprint discreetly, minimizing the risk of detection by the target's security systems.

Why this answer

Maltego is a tool that collects publicly available information from sources like DNS records, WHOIS databases, and social media without directly interacting with the target's systems. This aligns with passive reconnaissance, which relies on open-source intelligence (OSINT) and does not send any packets to the target's network. The CEH defines passive reconnaissance as gathering information without engaging the target, making option A correct.

Exam trap

EC-Council often tests the distinction between passive and active reconnaissance by presenting tools like Maltego or theHarvester as passive, while candidates mistakenly classify them as active due to the tool's interactive GUI or data aggregation features.

How to eliminate wrong answers

Option B is wrong because active reconnaissance involves direct interaction with the target's systems (e.g., sending probes, port scans, or vulnerability scans), which Maltego does not do by default. Option C is wrong because vulnerability scanning is a form of active reconnaissance that uses tools like Nessus or OpenVAS to identify weaknesses by sending malicious payloads, not OSINT gathering. Option D is wrong because social engineering involves manipulating people to divulge confidential information (e.g., phishing calls or pretexting), which is a separate attack vector not performed by Maltego's automated data mining.

Practice this question →
42
MCQmedium

An incident responder notices unusual outbound traffic from a host that is communicating with an external IP on port 4444. The traffic appears to be encrypted. Which tool could be used to initiate a connection to that external IP to gather a banner for service identification?

A.traceroute
B.nslookup
C.Telnet
D.ping
AnswerC

Telnet is an application-layer protocol and command-line utility that establishes a raw Transmission Control Protocol (TCP) connection to a specified port on a remote host. Upon successful connection, many network services are configured to immediately send an initial banner containing information such as the service type and version. This direct, interactive connection capability makes Telnet an effective tool for manually identifying unknown services by observing these initial banners.

Why this answer

Telnet can be used to connect to any TCP port, including port 4444, to manually interact with a service and retrieve its banner. Banners often reveal the service name, version, and other identifying information, which is critical for footprinting and reconnaissance. Even though the traffic is encrypted, the initial banner may be sent in cleartext before encryption begins, or the connection attempt itself can reveal the service type.

Exam trap

EC-Council often tests the misconception that Telnet is only for remote terminal access on port 23, but the exam expects you to know Telnet can connect to any TCP port for banner grabbing.

How to eliminate wrong answers

Option A is wrong because traceroute is used to map the network path to a destination by manipulating TTL values, not to connect to a specific port or retrieve a banner. Option B is wrong because nslookup is a DNS query tool used to resolve domain names to IP addresses or query DNS records; it cannot establish a TCP connection to a port. Option D is wrong because ping uses ICMP Echo Request/Reply messages and operates at the network layer; it cannot connect to a TCP port or retrieve application-layer banners.

Practice this question →
43
MCQmedium

During a penetration test, you execute `theHarvester -d example.com -b google,linkedin`. What type of data is this tool primarily designed to collect?

A.Password hashes and user credentials from compromised databases
B.Email addresses, subdomains, and employee names from public sources
C.DNS zone transfer information and TXT records
D.Vulnerability scan results from Nessus and OpenVAS
AnswerB

theHarvester excels at collecting crucial Open Source Intelligence (OSINT) such as email addresses, subdomains, and employee names by leveraging various public data sources. It systematically queries search engines like Google and Bing, social networks like LinkedIn, and specialized platforms like Shodan or Hunter.io, providing valuable initial reconnaissance data for penetration testers. This data is instrumental for crafting targeted phishing campaigns or identifying potential attack surfaces.

Why this answer

TheHarvester is an open-source intelligence (OSINT) tool designed to gather publicly available information from search engines, PGP key servers, and social platforms. The command `-d example.com -b google,linkedin` instructs it to scrape Google and LinkedIn for email addresses, subdomains, and employee names associated with the target domain, which are classic footprinting data used in reconnaissance.

Exam trap

The trap here is that candidates confuse theHarvester's passive OSINT collection with active reconnaissance tools like `dnsrecon` (for zone transfers) or `nmap` (for vulnerability scanning), leading them to select options C or D.

How to eliminate wrong answers

Option A is wrong because theHarvester does not query compromised databases or extract password hashes; that is the domain of tools like Have I Been Pwned or hashcat. Option C is wrong because DNS zone transfer information and TXT records are obtained via `dig` or `nslookup` with specific query types (AXFR, TXT), not through search engine scraping. Option D is wrong because vulnerability scan results from Nessus and OpenVAS are generated by active scanning tools, not by passive OSINT collection performed by theHarvester.

Practice this question →
44
MCQmedium

A security analyst is performing reconnaissance on a target domain and wants to discover all subdomains using DNS enumeration. Which of the following commands would be MOST effective for performing a DNS zone transfer attempt?

A.dig example.com ANY
B.nslookup -type=ns example.com
C.theHarvester -d example.com -l 500 -b google
D.dnsrecon -d example.com -t axfr
AnswerD

The `dnsrecon` utility, when invoked with the `-t axfr` flag, explicitly instructs the tool to attempt an AXFR (Asynchronous Full Zone Transfer) against the target domain. This command is specifically designed to enumerate all DNS records within a zone by requesting the entire zone file from the authoritative name servers. If successful due to misconfiguration, this provides a comprehensive map of the domain's infrastructure, including hostnames and IP addresses, which is highly valuable for reconnaissance.

Why this answer

The `-t axfr` flag in `dnsrecon` specifically attempts a DNS zone transfer (AXFR query) against the target domain's authoritative nameservers. A successful zone transfer returns all DNS records, including all subdomains, making it the most direct and effective method for subdomain enumeration via DNS zone transfer.

Exam trap

The trap here is that candidates often confuse general DNS queries (like `dig ANY` or `nslookup -type=ns`) with the specific zone transfer request (AXFR), assuming any DNS enumeration command can retrieve the full zone file.

How to eliminate wrong answers

Option A is wrong because `dig example.com ANY` queries for all record types but does not attempt a zone transfer; it only returns cached or non-authoritative data, not the full zone. Option B is wrong because `nslookup -type=ns example.com` only retrieves the nameserver records for the domain, not the entire zone file; it does not perform a zone transfer. Option C is wrong because `theHarvester -d example.com -l 500 -b google` uses search engines (Google) to gather subdomains via public sources, not DNS zone transfer; it relies on passive reconnaissance rather than direct DNS enumeration.

Practice this question →
45
MCQmedium

A penetration tester runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?

A.Perform a UDP scan on the four specified ports and identify running services
B.Perform an aggressive scan of all open ports and enumerate SMB shares
C.Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting
D.Perform a full TCP connect scan with UDP service detection on all ports
AnswerC

This statement accurately describes the Nmap command's functionality. The -sS flag initiates a TCP SYN scan, a common and relatively stealthy method for port scanning that avoids completing the full TCP handshake. The -sV flag enables service version detection, attempting to determine the exact software and version running on open TCP ports. Additionally, the -O flag instructs Nmap to attempt OS fingerprinting, identifying the target's operating system. Finally, the -p 22,80,443,3389 option restricts the scan to precisely these four specified TCP ports.

Why this answer

The command uses the -sS flag for a TCP SYN scan (stealth scan), -sV for service version detection, and -O for OS fingerprinting, targeting only the four specified ports (22, 80, 443, 3389) across the 192.168.1.0/24 subnet. This combination performs a half-open TCP scan on those ports, probes open ports to identify service versions, and attempts to determine the operating system based on TCP/IP stack responses.

Exam trap

The trap here is that candidates often confuse the -sS (SYN scan) with -sT (TCP connect scan) or -sU (UDP scan), and they may incorrectly assume that -sV and -O automatically scan all ports or perform additional enumeration like SMB sharing, when in fact the port range is explicitly limited by the -p option.

How to eliminate wrong answers

Option A is wrong because -sS specifies a TCP SYN scan, not a UDP scan; a UDP scan would use -sU, and the command does not include that flag. Option B is wrong because while -sV and -O make the scan somewhat aggressive, the command does not enumerate SMB shares (which would require scripts like smb-enum-shares via -sC or --script), and it only scans four specific ports, not all open ports. Option D is wrong because -sS is a SYN scan, not a full TCP connect scan (which would use -sT), and there is no UDP service detection (which would require -sU); also, the scan is limited to four ports, not all ports.

Practice this question →
46
MCQmedium

A security analyst runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?

A.Perform a full TCP connect scan with UDP service detection on all ports
B.Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting
C.Perform an aggressive scan of all open ports and enumerate SMB shares
D.Perform a UDP scan on the four specified ports and identify running services
AnswerB

-sS = SYN/stealth scan, -sV = version detection, -O = OS fingerprinting, -p 22,80,443,3389 = scan only these four ports. This is a targeted reconnaissance scan.

Why this answer

The `-sS` flag initiates a TCP SYN stealth scan, `-sV` enables service version detection, and `-O` attempts OS fingerprinting. The `-p 22,80,443,3389` limits the scan to those four ports, and the target `192.168.1.0/24` scans the entire Class C subnet. This combination performs a half-open scan on the specified ports, probes for application versions, and tries to identify the operating system of each live host.

Exam trap

The trap here is that candidates confuse `-sS` (SYN scan) with a full connect scan (`-sT`) or mistakenly think `-sV` and `-O` imply an aggressive scan (`-A`), which also includes default scripts and traceroute.

How to eliminate wrong answers

Option A is wrong because `-sS` performs a TCP SYN scan (half-open), not a full TCP connect scan (`-sT`), and the command does not include UDP scanning (`-sU`) or scan all ports (only four are specified). Option C is wrong because the command does not use the `-A` flag (aggressive scan) and does not include any SMB enumeration flags like `--script smb-enum-shares`. Option D is wrong because `-sS` is a TCP SYN scan, not a UDP scan (`-sU`), and while `-sV` identifies services, it does so over TCP, not UDP.

Practice this question →
47
MCQeasy

Which of the following tools is specifically designed to perform fast internet-wide scanning, often used in the reconnaissance phase to discover open ports across large IP ranges?

A.hping3
B.OpenVAS
C.Masscan
D.Nmap
AnswerC

Masscan is designed for high-speed scanning of large address spaces.

Why this answer

Masscan is specifically designed for high-speed, asynchronous scanning of large IP ranges, capable of transmitting packets at rates exceeding 10 million packets per second. This makes it the optimal tool for internet-wide reconnaissance to discover open ports across vast address spaces, a task for which Nmap is too slow and hping3 is too manual.

Exam trap

The trap here is that candidates often choose Nmap because it is the most famous scanning tool, but the question specifically asks for a tool designed for 'fast internet-wide scanning,' which is Masscan's unique selling point over Nmap's slower, more thorough approach.

How to eliminate wrong answers

Option A is wrong because hping3 is a packet crafting and manipulation tool used for custom TCP/IP testing and firewall auditing, not for high-speed internet-wide scanning. Option B is wrong because OpenVAS is a vulnerability scanner that performs deep analysis on a targeted set of hosts, not a tool designed for rapid, large-scale port discovery. Option D is wrong because while Nmap is a powerful and versatile scanner, its synchronous scanning engine is too slow for scanning the entire internet; Masscan was explicitly created to fill this performance gap.

Practice this question →
48
Multi-Selecteasy

Which TWO of the following are considered passive reconnaissance techniques? (Choose TWO.)

Select 2 answers
A.Ping sweep
B.WHOIS lookup
C.Banner grabbing with Telnet
D.Port scanning
E.Google dorking
AnswersB, E

A WHOIS lookup is a classic example of passive reconnaissance because it involves querying publicly available databases maintained by domain registrars and registries. This process retrieves information such as domain ownership, registration dates, and contact details without sending any packets directly to the target organization's network. Since the interaction is solely with a third-party database, the target system remains unaware of the information gathering attempt.

Why this answer

WHOIS lookup is a passive reconnaissance technique because it queries public domain registration databases (via WHOIS protocol, RFC 3912) to obtain information such as registrar, registrant contact details, name servers, and expiration dates. This process does not send any packets directly to the target's infrastructure; instead, it relies on third-party data sources, making it undetectable by the target.

Exam trap

The trap here is that candidates often confuse 'passive' with 'low-noise' techniques, mistakenly thinking a ping sweep or banner grabbing is passive because it doesn't exploit vulnerabilities, but any technique that sends packets to the target's systems is active by definition.

Practice this question →
49
MCQhard

You are investigating a suspected data exfiltration. Network logs show an internal host performing numerous DNS queries to a domain that does not exist in any organization records. The queries use various subdomains. Which technique is the attacker MOST likely using?

A.DNS amplification attack
B.DNS cache poisoning
C.DNS zone transfer
D.DNS tunneling
AnswerD

DNS tunneling is a sophisticated data exfiltration technique that encapsulates arbitrary data within DNS queries and responses, creating a covert communication channel. Attackers use this method to bypass firewalls and intrusion detection systems that typically allow DNS traffic, enabling them to extract sensitive information from a compromised internal network to an external command-and-control server. This technique effectively hides data transfer in plain sight, making it a potent tool for stealthy data theft.

Why this answer

The attacker is most likely using DNS tunneling, which encodes data from exfiltrated information into DNS queries and responses. By making numerous DNS queries to a domain they control, with data encoded in the subdomain labels, the attacker can bypass network security controls that do not inspect DNS traffic deeply. The fact that the domain does not exist in organization records and uses various subdomains is a classic indicator of DNS tunneling.

Exam trap

The trap here is that candidates confuse DNS tunneling with DNS amplification attacks because both involve many DNS queries, but amplification is a DDoS technique focused on volume, not covert data exfiltration via subdomain encoding.

How to eliminate wrong answers

Option A is wrong because a DNS amplification attack is a volumetric DDoS technique that uses open resolvers to flood a victim with large DNS responses, not to exfiltrate data via subdomain queries. Option B is wrong because DNS cache poisoning corrupts a resolver's cache with forged records to redirect traffic, not to exfiltrate data through numerous subdomain queries. Option C is wrong because a DNS zone transfer is a legitimate mechanism to replicate DNS records between authoritative servers, typically using TCP port 53 and the AXFR query type, not a method for data exfiltration via subdomain queries.

Practice this question →
50
MCQeasy

What is the PRIMARY purpose of performing a DNS zone transfer?

A.To cache DNS queries locally
B.To obtain all DNS records for a domain from an authoritative server
C.To resolve IP addresses to hostnames
D.To verify the DNS server's response time
AnswerB

The primary purpose of performing a DNS zone transfer (AXFR or IXFR) is to replicate the entire set of DNS resource records (RRs) for a specific domain from a primary authoritative DNS server to a secondary authoritative DNS server. This process ensures that all secondary servers have an up-to-date, complete copy of the zone file, enabling them to authoritatively answer queries for the domain even if the primary server is unavailable. For ethical hackers, a successful zone transfer can reveal extensive network topology information.

Why this answer

DNS zone transfer (AXFR) is a mechanism defined in RFC 1034 and 1035 that allows a secondary DNS server to replicate the entire zone file from a primary authoritative server. The primary purpose is to obtain all DNS records for a domain, which is critical for reconnaissance during the footprinting phase, as it reveals subdomains, mail servers, and other infrastructure without brute-forcing.

Exam trap

EC-Council often tests the distinction between a zone transfer (full record replication) and a standard DNS query (single record lookup), so candidates mistakenly choose option C because they confuse reverse lookup with the bulk data retrieval of AXFR.

How to eliminate wrong answers

Option A is wrong because caching DNS queries locally is the function of a DNS resolver or caching server, not the purpose of a zone transfer; zone transfers replicate authoritative records, not cached queries. Option C is wrong because resolving IP addresses to hostnames is a reverse DNS lookup (PTR record query), which is a separate operation from a zone transfer that copies the entire forward zone. Option D is wrong because verifying the DNS server's response time is a performance check (e.g., using dig +stats), not a function of zone transfers, which are about data replication.

Practice this question →
51
MCQeasy

Which Nmap flag is used to perform a TCP SYN scan without completing the three-way handshake?

A.-sS
B.-sT
C.-sU
D.-sA
AnswerA

The -sS flag initiates a TCP SYN scan, often referred to as a "stealth scan" because it does not complete the full TCP three-way handshake. Nmap sends a SYN packet and, if a SYN/ACK is received, it immediately sends an RST packet instead of the final ACK. This technique helps avoid logging on the target system as a full connection is never established, making it less intrusive and harder to detect by some firewalls and intrusion detection systems.

Why this answer

The -sS flag instructs Nmap to perform a TCP SYN scan, which sends a SYN packet to the target port and, upon receiving a SYN/ACK response, sends an RST packet instead of completing the three-way handshake with an ACK. This allows the scanner to determine port states without establishing a full TCP connection, making it faster and less detectable than a full connect scan.

Exam trap

The trap here is that candidates often confuse -sS (SYN scan) with -sT (TCP connect scan), mistakenly thinking that -sT also avoids completing the handshake, when in fact -sT completes the full three-way handshake and is logged by the target system.

How to eliminate wrong answers

Option B (-sT) is wrong because it performs a full TCP connect scan, which completes the three-way handshake by sending the final ACK, making it more detectable and slower. Option C (-sU) is wrong because it performs a UDP scan, which sends UDP packets and does not involve the TCP three-way handshake at all. Option D (-sA) is wrong because it performs a TCP ACK scan, which sends packets with the ACK flag set to map firewall rules, not to determine open ports via SYN responses.

Practice this question →
52
MCQmedium

A penetration tester is performing reconnaissance and wants to identify email addresses associated with a target domain. Which tool is specifically designed for this purpose?

A.Nmap
B.theHarvester
C.Shodan
D.Maltego
AnswerB

theHarvester is an open-source intelligence (OSINT) tool specifically engineered for gathering publicly available information, including email addresses, subdomains, hostnames, and employee names. It achieves this by querying various public data sources such as search engines (e.g., Google, Bing), PGP key servers, and social media platforms like LinkedIn. This targeted approach makes theHarvester highly effective during the reconnaissance phase for compiling lists of potential email targets from publicly accessible information.

Why this answer

TheHarvester is specifically designed for passive reconnaissance to gather email addresses, subdomains, and other open-source intelligence (OSINT) from public sources like search engines, PGP key servers, and the SHODAN database. It directly queries these sources to extract email addresses associated with a target domain, making it the correct tool for this task.

Exam trap

The trap here is that candidates often confuse Shodan (a device search engine) with a tool for email harvesting, or they assume Maltego's broad OSINT capabilities make it the best choice, but theHarvester is the only option specifically designed for automated email address extraction from public sources.

How to eliminate wrong answers

Option A is wrong because Nmap is a network scanning tool used for port scanning, service detection, and OS fingerprinting, not for harvesting email addresses from public sources. Option C is wrong because Shodan is a search engine for internet-connected devices and services, not a tool for extracting email addresses from a target domain. Option D is wrong because Maltego is a graphical link analysis tool for relationship mapping and OSINT, but it is not specifically designed for automated email harvesting; it requires manual configuration and transforms, whereas theHarvester is purpose-built for this task.

Practice this question →
53
MCQhard

During a security assessment, you execute: dnsenum --enum example.com. The tool returns results including the nameservers (NS), mail servers (MX), and performs a zone transfer attempt. The zone transfer fails. What is the MOST likely reason for the failure?

A.The DNS server is not running
B.The zone transfer requires TCP port 443
C.The DNS server is configured to deny zone transfers from unauthorized hosts
D.The domain does not exist
AnswerC

When `dnsenum` successfully enumerates NS and MX records but subsequently fails to perform a zone transfer, it is a clear indication that the DNS server is active and the domain exists, but it is specifically configured to deny zone transfer requests from unauthorized hosts. This is a standard and recommended security practice, often implemented via `allow-transfer` directives, to prevent attackers from obtaining a full list of domain records.

Why this answer

DNS zone transfers (AXFR) are typically restricted by default on authoritative DNS servers to prevent unauthorized disclosure of the entire zone file. The `dnsenum` tool attempts an AXFR query over TCP port 53, and the failure indicates the server explicitly denied the request, which is a standard security configuration per RFC 5936.

Exam trap

The trap here is that candidates may confuse the port used for zone transfers (TCP 53) with the standard DNS query port (UDP 53) or mistakenly think a failed zone transfer implies the server is down or the domain is invalid, rather than recognizing it as a deliberate security control.

How to eliminate wrong answers

Option A is wrong because if the DNS server were not running, the tool would not have returned NS and MX records; a non-responsive server would cause a timeout or connection error, not a specific zone transfer failure. Option B is wrong because zone transfers use TCP port 53, not TCP port 443 (which is used for HTTPS). Option D is wrong because the tool successfully resolved the domain (returning NS and MX records), proving the domain exists and is properly configured.

Practice this question →
54
Multi-Selectmedium

A penetration tester wants to perform DNS zone transfer enumeration. Which TWO of the following tools can be used for this purpose? (Select exactly 2.)

Select 2 answers
A.Shodan
B.Maltego
C.theHarvester
D.dnsrecon
E.dnsenum
AnswersD, E

dnsrecon is a dedicated DNS enumeration script specifically designed to gather extensive information about DNS infrastructure. It actively attempts various DNS queries, including brute-forcing subdomains, checking for wildcards, and crucially, attempting zone transfers (AXFR requests) against identified name servers. This tool is specifically built to uncover misconfigured DNS servers that might inadvertently disclose internal network details through successful zone transfers, making it highly effective for this task.

Why this answer

Dnsrecon is a dedicated DNS enumeration tool that supports zone transfer requests (AXFR queries) to retrieve all DNS records from a nameserver if it is misconfigured to allow transfers from any host. It can also perform other DNS reconnaissance tasks such as SRV record enumeration and subdomain brute-forcing, making it a direct choice for zone transfer enumeration.

Exam trap

EC-Council often tests the distinction between passive reconnaissance tools (theHarvester, Maltego) and active DNS enumeration tools (dnsrecon, dnsenum) that directly query DNS servers for zone transfers, leading candidates to select tools that gather DNS data indirectly rather than performing the actual AXFR request.

Practice this question →
55
Multi-Selectmedium

Which THREE of the following are examples of OSINT techniques? (Choose 3)

Select 3 answers
A.Nmap version detection
B.Shodan search
C.Maltego graph analysis
D.Nessus vulnerability scan
E.Google dorking
AnswersB, C, E

Shodan is a powerful OSINT search engine that passively collects information about internet-connected devices, services, and their configurations by continuously scanning the entire internet. Users can then query this vast database to discover exposed ports, vulnerable services, and device metadata without directly interacting with the target, making it a prime example of open-source intelligence.

Why this answer

Shodan is a search engine for internet-connected devices, allowing users to discover open ports, services, and banners without directly interacting with the target. This is a classic OSINT technique because it gathers publicly available information from external sources, not from active scanning of the target's own infrastructure.

Exam trap

EC-Council often tests the distinction between active and passive reconnaissance, and the trap here is that candidates confuse tools that can be used for both (like Nmap) with OSINT, forgetting that OSINT specifically excludes any direct interaction with the target system.

Practice this question →
56
MCQmedium

A security analyst runs `nmap -sU -p 161,162 10.0.0.1` and receives output showing port 161/udp is open. Which service is MOST likely running on this port?

A.DHCP
B.SNMP
C.TFTP
D.DNS
AnswerB

SNMP uses UDP ports 161 (agent) and 162 (manager).

Why this answer

Port 161/udp is the default port for SNMP (Simple Network Management Protocol) used by SNMP agents to receive management queries (GET, SET) from SNMP managers. The `-sU` flag performs a UDP scan, and the open result on 161/udp strongly indicates an SNMP service is listening, as defined in RFC 1157.

Exam trap

The trap here is that candidates often confuse SNMP's port 161 with SNMP trap port 162 or misattribute it to other UDP-based services like DHCP or TFTP, but the scan specifically targets 161, which is exclusively SNMP.

How to eliminate wrong answers

Option A is wrong because DHCP uses ports 67/udp (server) and 68/udp (client), not 161 or 162. Option C is wrong because TFTP uses port 69/udp, not 161 or 162. Option D is wrong because DNS uses port 53/udp (and tcp), not 161 or 162.

Practice this question →
57
MCQeasy

Which command-line tool is specifically designed to extract email addresses, subdomains, and other information from public sources (e.g., search engines, social media) for a given domain?

A.Metasploit
B.Nmap
C.theHarvester
D.Wireshark
AnswerC

theHarvester is a specialized command-line tool explicitly engineered for passive information gathering, or Open Source Intelligence (OSINT), by querying public data sources. It systematically extracts valuable intelligence such as email addresses, subdomains, hostnames, employee names, and banner information from search engines like Google and Bing, as well as public databases like Shodan and Hunter.io, without directly interacting with the target network.

Why this answer

theHarvester is a dedicated open-source intelligence (OSINT) tool designed to gather emails, subdomains, IPs, and employee names from public sources such as Google, Bing, LinkedIn, and PGP key servers. It specifically targets a given domain and queries search engines and social media APIs to extract this reconnaissance data, making it the correct choice for this task.

Exam trap

The trap here is that candidates may confuse theHarvester with Nmap or Metasploit because all three are used in reconnaissance, but only theHarvester specializes in passive OSINT gathering from public sources rather than active scanning or exploitation.

How to eliminate wrong answers

Option A is wrong because Metasploit is a penetration testing framework focused on exploit development and payload delivery, not passive information gathering from public sources. Option B is wrong because Nmap is a network scanning tool that discovers live hosts and open ports via raw packet probes, not designed to extract email addresses or subdomains from search engines. Option D is wrong because Wireshark is a packet analyzer that captures and inspects network traffic at the data-link layer, not a tool for querying public sources for domain-related information.

Practice this question →
58
MCQmedium

A penetration tester runs the following command: masscan 10.0.0.0/24 -p80,443,8080 --rate=10000. Compared to Nmap, what is the PRIMARY advantage of using Masscan for this scan?

A.Masscan can scan a large number of hosts and ports at very high speed
B.Masscan provides more detailed service version detection than Nmap
C.Masscan is stealthier than Nmap and less likely to be detected
D.Masscan can scan all 65535 ports faster than Nmap
AnswerA

Masscan is specifically engineered for high-performance, asynchronous SYN scanning across vast IP ranges. Its custom TCP/IP stack allows it to send SYN packets and process SYN-ACK responses at rates exceeding millions of packets per second, far surpassing traditional scanners. This design enables rapid discovery of open ports across entire internet segments or all 65,535 ports on numerous targets, making it ideal for large-scale reconnaissance.

Why this answer

Masscan is designed for asynchronous, high-speed scanning, capable of transmitting packets at rates exceeding 10 million packets per second. In this command, the `--rate=10000` parameter sets a transmission rate of 10,000 packets per second, allowing it to scan the entire 10.0.0.0/24 subnet (256 hosts) for three ports in a fraction of the time Nmap would require. Nmap, while feature-rich, operates synchronously by default and cannot match Masscan's raw packet throughput for large-scale port scanning.

Exam trap

EC-Council often tests the misconception that Masscan is stealthier than Nmap, but in reality, its high packet rate makes it more detectable, and the trap here is that candidates confuse speed with stealth.

How to eliminate wrong answers

Option B is wrong because Masscan does not perform service version detection; it is a raw port scanner that only identifies open ports, whereas Nmap's `-sV` flag provides detailed service and version fingerprinting. Option C is wrong because Masscan is not inherently stealthier; its high-speed, asynchronous scanning often generates more conspicuous traffic patterns and can trigger IDS/IPS alerts more easily than Nmap's slower, more deliberate scans. Option D is wrong because while Masscan can scan all 65535 ports faster than Nmap, the question specifically asks about the PRIMARY advantage for the given command (which targets only three ports), and the core advantage is its high-speed scanning capability across many hosts, not just port range coverage.

Practice this question →
59
Multi-Selecthard

Which THREE of the following Nmap flags are commonly used for evasion techniques? (Select 3)

Select 3 answers
A.-f
B.-D
C.--mtu
D.-O
E.-sV
AnswersA, B, C

The -f flag instructs Nmap to fragment the probe packets into smaller pieces, typically 8 bytes or less, before sending them. This technique can bypass stateless firewalls or basic Intrusion Detection Systems (IDS) that only inspect the first fragment of a packet or fail to reassemble fragmented packets correctly. By splitting the TCP header across multiple fragments, it becomes harder for security devices to identify the true nature of the scan, making it a common evasion tactic.

Why this answer

The -f flag fragments the probe packets into smaller 8-byte fragments (or less, depending on the MTU). This helps evade simple packet-filtering firewalls and intrusion detection systems that do not reassemble fragments before applying rules, as the fragmented headers may bypass signature-based detection.

Exam trap

EC-Council often tests the distinction between scanning techniques (like -O and -sV) and evasion techniques (like -f, -D, --mtu), so candidates mistakenly select -O or -sV because they are common Nmap flags, even though they serve reconnaissance, not evasion.

Practice this question →
60
MCQmedium

Which of the following Nmap flags would an attacker use to evade IDS by sending fragmented IP packets?

A.-D
B.-g
C.-sS
D.-f
AnswerD

The -f (or --fragment) flag instructs Nmap to fragment the IP packets it sends into several smaller pieces. This technique is specifically designed to evade simple packet filters and intrusion detection systems (IDS) that might inspect only the first fragment of a packet or have difficulty reassembling fragmented packets correctly. By splitting the TCP or UDP header across multiple fragments, it can bypass rules that look for specific header information in a single, complete packet, thus aiding in stealth.

Why this answer

The -f flag in Nmap instructs the tool to fragment the transmitted packets into smaller pieces (typically 8-byte fragments). This fragmentation is used to evade Intrusion Detection Systems (IDS) that rely on signature matching against complete, unfragmented packets, as the IDS may not reassemble the fragments before inspection or may fail to detect the malicious payload when spread across multiple fragments.

Exam trap

The trap here is that candidates often confuse the -f flag with the -D (decoy) flag, thinking both are used for evasion, but -f specifically targets packet fragmentation to bypass IDS, while -D hides the source IP.

How to eliminate wrong answers

Option A (-D) is wrong because the -D flag is used for decoy scanning, which spoofs multiple source IP addresses to hide the attacker's real IP, not to fragment packets. Option B (-g) is wrong because the -g flag sets a custom source port number for the scan, often to bypass firewall rules that allow traffic from specific ports (e.g., port 53 for DNS), and has nothing to do with fragmentation. Option C (-sS) is wrong because -sS performs a TCP SYN stealth scan, which sends SYN packets without completing the handshake to avoid connection logging, but it does not involve IP fragmentation.

Practice this question →
61
MCQmedium

A security analyst receives an alert about a scan originating from an IP address that appears to be using a 'sIdle scan' technique. Which of the following characteristics would confirm this?

A.The scan uses fragmented packets and decoy IP addresses
B.The scan uses FTP bounce to hide the true source IP
C.The scan sends SYN packets with the zombie host's IP address as the source and monitors IPID changes on the zombie to determine open ports
D.The scan shows a SYN packet with the attacker's real IP but uses a zombie host to relay replies
AnswerC

This option accurately describes the idle scan's core methodology. The attacker first probes an idle "zombie" host to record its current IPID (IP Identification field). Subsequently, the attacker sends spoofed SYN packets to the target, using the zombie's IP address as the source. If the target port is open, it responds with a SYN-ACK to the zombie, causing the zombie to send an RST to the target and increment its IPID. If the target port is closed, it responds with an RST to the zombie, which does not increment the zombie's IPID. A final probe to the zombie reveals whether its IPID has incremented, indicating an open port on the target.

Why this answer

An idle scan (also known as a zombie scan) relies on sending SYN packets to the target with the spoofed source IP address of a zombie host, then monitoring the IPID sequence on that zombie to infer whether the target port is open, closed, or filtered. The key characteristic is the use of the zombie's IP as the source and the observation of IPID changes on the zombie, which is exactly what option C describes.

Exam trap

The trap here is that candidates often confuse the idle scan with other spoofing or relay techniques like FTP bounce or decoy scans, but the idle scan is uniquely defined by the use of a zombie host's IPID changes to infer port states, not by hiding the attacker's IP via relays or multiple decoys.

How to eliminate wrong answers

Option A is wrong because fragmented packets and decoy IP addresses are features of a fragmented scan or a decoy scan, not an idle scan; idle scan does not use fragmentation or multiple decoy IPs. Option B is wrong because FTP bounce is a separate technique that uses an FTP server to relay traffic and hide the true source, but it does not involve monitoring IPID changes on a zombie host. Option D is wrong because an idle scan does not send SYN packets with the attacker's real IP; the attacker's IP is never used in the probe packets—the zombie's IP is used as the source, and the zombie does not relay replies; instead, the attacker monitors the zombie's IPID to infer port states.

Practice this question →
62
MCQeasy

Which of the following tools is specifically designed for high-speed port scanning across large address spaces?

A.Masscan
B.Zenmap
C.hping3
D.Nmap
AnswerA

Masscan is purpose-built for extremely high-speed network scanning, capable of transmitting millions of packets per second across the internet. It achieves this unparalleled speed by employing a custom, asynchronous TCP/IP stack and operating in a stateless manner, primarily focusing on rapid port discovery rather than detailed service enumeration. This design allows it to scan the entire IPv4 address space for specific ports in mere minutes, making it ideal for large-scale reconnaissance and vulnerability mapping.

Why this answer

Masscan is specifically designed for high-speed port scanning across large address spaces, capable of transmitting packets at rates exceeding 10 million packets per second. It achieves this by using asynchronous transmission and a custom TCP/IP stack, making it ideal for scanning the entire IPv4 internet or massive subnets in minutes, unlike general-purpose scanners that prioritize accuracy over raw speed.

Exam trap

The trap here is that candidates often assume Nmap is the fastest scanning tool because of its popularity and extensive feature set, but Masscan is explicitly engineered for raw speed at the cost of some accuracy, which is the key differentiator tested in this question.

How to eliminate wrong answers

Option B (Zenmap) is wrong because it is merely a graphical front-end for Nmap, not a standalone high-speed scanner; it inherits Nmap's slower, more thorough scanning approach. Option C (hping3) is wrong because it is a packet crafting and testing tool focused on custom packet generation and firewall testing, not optimized for high-speed port scanning across large address spaces. Option D (Nmap) is wrong because while it is a powerful and versatile scanner, it is designed for detailed, reliable scans with features like service detection and OS fingerprinting, and its default scanning methods are significantly slower than Masscan's asynchronous approach.

Practice this question →
63
MCQhard

During a penetration test, a tester uses Nmap with the command: nmap -sS -D RND:10 192.168.1.100. After the scan, the IDS logs show multiple SYN packets from different source IPs hitting the target. However, the tester's true IP is not among them. Which of the following techniques is being used?

A.Idle scan
B.SYN flood
C.Decoy scan
D.Fragmentation attack
AnswerC

A Decoy scan, initiated with the -D flag, is a technique used to obfuscate the true source IP address of the scanner by interspersing it with multiple decoy IP addresses. When RND:10 is used, Nmap generates 10 random, non-existent IP addresses (or existing ones if specified) and sends scan packets from these decoys, along with the actual scanner's IP. This makes it challenging for intrusion detection systems (IDS) or firewall logs to pinpoint the actual origin of the scan amidst the noise generated by the decoys.

Why this answer

The command `nmap -sS -D RND:10` performs a SYN stealth scan with 10 randomly generated decoy IP addresses. The IDS logs show multiple SYN packets from different source IPs, but the tester's true IP is not among them because Nmap sends the decoy packets with spoofed source addresses while the real scan packet is interleaved among them. This is the definition of a decoy scan, which aims to obscure the attacker's true origin by blending it with fake sources.

Exam trap

The trap here is confusing decoy scans with idle scans, as both involve spoofed IPs, but idle scans require a zombie host and IPID manipulation, while decoy scans simply flood the target with fake sources to hide the real one.

How to eliminate wrong answers

Option A is wrong because an idle scan (nmap -sI) uses a zombie host to bounce scan traffic off, relying on IPID sequence analysis, not multiple random source IPs. Option B is wrong because a SYN flood is a denial-of-service attack that sends a high volume of SYN packets to overwhelm the target, not a stealth scanning technique to hide the tester's IP. Option D is wrong because a fragmentation attack (nmap -f) splits packets into smaller fragments to evade IDS/IPS signature detection, but does not spoof source IPs or use decoys.

Practice this question →
64
MCQhard

A security analyst notices that their Nmap scan results show all ports as 'filtered' despite the target host being alive and responsive to ping. Which of the following is the MOST likely cause?

A.The analyst's machine has a misconfigured routing table
B.The target has a host-based firewall that drops all incoming traffic silently
C.The target is running a honeypot that mimics multiple services
D.The target is an idle host that does not respond to any traffic
AnswerB

When Nmap reports a port as "filtered," it means that the Nmap probe packets (e.g., SYN for TCP, ICMP for UDP) reached the target, but no response was received from the target host. This behavior is characteristic of a firewall, either host-based or network-based, configured to silently drop incoming traffic without sending an RST packet (for TCP) or an ICMP Port Unreachable message (for UDP). Such silent drops prevent Nmap from determining the port's true state (open or closed), leading to the "filtered" classification.

Why this answer

When an Nmap scan shows all ports as 'filtered', it indicates that the target is reachable (since ping succeeds) but the probe packets (e.g., SYN, ACK) are being dropped without any response. A host-based firewall configured to silently drop all incoming traffic is the most likely cause, as it prevents Nmap from receiving RST or SYN/ACK replies, leading to the 'filtered' state for every port.

Exam trap

The trap here is that candidates often confuse 'filtered' with 'closed' or 'open', or assume a host that responds to ping must have open ports, but a firewall can silently drop all inbound TCP/UDP probes while still allowing ICMP echo requests.

How to eliminate wrong answers

Option A is wrong because a misconfigured routing table on the analyst's machine would likely cause no response at all (including ping failure) or asymmetric routing issues, not a consistent 'filtered' state on all ports while ping succeeds. Option C is wrong because a honeypot mimicking multiple services would typically respond to probes (e.g., with SYN/ACK or banners) to attract attackers, resulting in 'open' or 'closed' port states, not 'filtered'. Option D is wrong because an idle host that does not respond to any traffic would not respond to ping either, contradicting the scenario where the target is alive and responsive to ping.

Practice this question →
65
Multi-Selectmedium

Which TWO techniques are considered active reconnaissance? (Choose TWO.)

Select 2 answers
A.Using Google dorking to find exposed files
B.Querying Shodan for exposed devices
C.Port scanning with Nmap
D.Banner grabbing with Netcat
E.Performing a WHOIS lookup
AnswersC, D

Port scanning with Nmap is a quintessential active reconnaissance technique because it involves sending specially crafted packets directly to a target host. Nmap probes specific TCP or UDP ports to determine their state (open, closed, filtered) and identify running services. This direct interaction generates network traffic that the target's firewalls or intrusion detection systems can log, making it detectable and undeniably active.

Why this answer

Port scanning with Nmap (Option C) is active reconnaissance because it sends crafted packets (e.g., TCP SYN, UDP probes) directly to target systems and analyzes the responses to determine open ports, running services, and operating system details. Banner grabbing with Netcat (Option D) is also active reconnaissance as it establishes a TCP connection to a target service (e.g., HTTP, FTP) and reads the service banner, which involves direct interaction with the target. Both techniques generate detectable network traffic and can be logged by intrusion detection systems.

Exam trap

The trap here is that candidates confuse 'using a tool that sometimes performs active scanning' (like Shodan, which actively scans on its own) with the user's action being active; the key distinction is whether the user's query directly interacts with the target system.

Practice this question →
66
MCQeasy

A security analyst wants to identify all live hosts on a network without generating excessive traffic. Which of the following techniques is MOST appropriate for this purpose?

A.Banner grabbing with Netcat
B.Full TCP connect scan on all ports
C.UDP scan on common ports
D.Ping sweep using ICMP echo requests
AnswerD

A ping sweep, also known as an ICMP sweep, is a highly efficient and low-traffic method for host discovery that involves sending ICMP echo request packets to a range of IP addresses. Any host that is live and configured to respond to ICMP will send an ICMP echo reply packet back to the sender. The receipt of these replies reliably indicates the presence of an active host on the network, making it a foundational and quick technique for initial network reconnaissance.

Why this answer

A ping sweep using ICMP Echo Requests (Type 8) is the most efficient method to identify live hosts on a network because it sends a single packet per target and listens for ICMP Echo Replies (Type 0). This generates minimal traffic compared to full port scans, making it ideal for initial reconnaissance without overwhelming the network or triggering intrusion detection systems.

Exam trap

The trap here is that candidates often confuse host discovery with service discovery, choosing a port-based scan (like TCP connect or UDP) because they think 'scanning' always involves ports, but the question explicitly asks for identifying live hosts with minimal traffic, which is the textbook purpose of a ping sweep.

How to eliminate wrong answers

Option A is wrong because banner grabbing with Netcat requires an active TCP connection to a specific port on a host, which is a post-discovery technique used to identify services, not to find live hosts, and it generates more traffic per host than a simple ping. Option B is wrong because a full TCP connect scan on all 65,535 ports per host would generate massive traffic (thousands of packets per host), defeating the goal of minimizing network load and being easily detected. Option C is wrong because a UDP scan on common ports sends datagrams that often receive no response (due to stateless nature or firewalls), making it unreliable for host discovery and still generating more traffic than a single ICMP packet per host.

Practice this question →
67
MCQhard

A security analyst observes that an Nmap SYN scan against a target network returns all ports as 'filtered'. The analyst suspects an IDS/IPS is dropping inbound SYN packets. Which Nmap technique would MOST likely bypass this detection while still identifying open ports?

A.Enable IP fragmentation with the -f flag
B.Use the -sU flag for UDP scanning
C.Use the -sT flag for a TCP connect scan
D.Increase scanning speed with -T5
AnswerA

Fragmentation can help evade detection by splitting the SYN packet across multiple fragments.

Why this answer

When an IDS/IPS drops inbound SYN packets, a standard SYN scan (-sS) is detected because the probe packets are easily recognized. Enabling IP fragmentation with the -f flag splits the TCP header across multiple fragments, making it harder for the IDS/IPS to reassemble and inspect the full packet, thus potentially bypassing the filter while still allowing Nmap to determine open ports based on responses.

Exam trap

The trap here is that candidates often think increasing speed (-T5) or using a full connect scan (-sT) makes scanning stealthier, when in fact fragmentation (-f) is the classic evasion technique for bypassing packet filters and IDS/IPS that inspect full packets.

How to eliminate wrong answers

Option B is wrong because UDP scanning (-sU) sends UDP datagrams, not SYN packets, and would not bypass a filter that drops inbound SYN packets; it also does not help identify open TCP ports. Option C is wrong because a TCP connect scan (-sT) completes the full three-way handshake, which still uses SYN packets and is even more detectable than a SYN scan, not less. Option D is wrong because increasing scanning speed with -T5 makes the scan more aggressive and noisy, which is more likely to trigger IDS/IPS alerts rather than bypass them.

Practice this question →
68
MCQmedium

During a penetration test, a tester runs 'dnsrecon -d example.com -t axfr' and receives a full list of DNS records. What does this indicate about the target's DNS configuration?

A.The DNS server has DNSSEC enabled
B.The DNS server allows recursive queries
C.The DNS server allows zone transfers from any host
D.The DNS server is authoritative for the domain
AnswerC

The `dnsrecon` tool, when used with the `-d` flag, attempts to perform a zone transfer (AXFR) from the specified domain's DNS servers. A successful execution, as implied by the question context, indicates that the DNS server is configured to permit full zone transfers to any requesting host, including unauthorized external entities. This represents a significant security misconfiguration, as it exposes sensitive network topology and host information.

Why this answer

The 'dnsrecon -d example.com -t axfr' command performs a DNS zone transfer (AXFR) request. Receiving a full list of DNS records indicates that the target DNS server is misconfigured to allow zone transfers from any host, which exposes the entire DNS zone data (including internal hostnames and IP addresses) to unauthorized parties. This is a critical information disclosure vulnerability.

Exam trap

The trap here is that candidates confuse 'authoritative' with 'vulnerable' — being authoritative is normal, but allowing unrestricted zone transfers is the misconfiguration; EC-Council often tests this by making option D sound correct because the server is authoritative, but the real issue is the lack of access control on the AXFR query.

How to eliminate wrong answers

Option A is wrong because DNSSEC (DNS Security Extensions) provides data integrity and authentication via digital signatures, but it does not control or prevent zone transfers; a server can have DNSSEC enabled and still allow unauthorized AXFR. Option B is wrong because recursive queries allow the DNS server to resolve queries for external domains on behalf of clients, which is a separate setting (often controlled by 'allow-recursion') and not directly related to zone transfer permissions. Option D is wrong because being authoritative for a domain means the server holds the official zone data for that domain, which is normal and expected; the security issue is not that it is authoritative, but that it allows zone transfers from any host without restriction.

Practice this question →
69
MCQeasy

Which Google dork would a penetration tester use to find login pages of websites that have 'admin' in the URL?

A.site:admin login
B.filetype:pdf admin login
C.intitle:"login" inurl:admin
D.inurl:"admin" inurl:"login"
AnswerD

This dork effectively leverages the `inurl:` operator, which specifically restricts search results to pages where the specified keyword appears within the URL string. By combining `inurl:"admin"` and `inurl:"login"`, the search precisely targets web pages that contain both "admin" and "login" within their URL paths. This combination is highly effective for identifying administrative login interfaces, as these keywords frequently appear together in the URLs of such sensitive portals.

Why this answer

The Google dork `inurl:"admin" inurl:"login"` specifically searches for pages where both 'admin' and 'login' appear in the URL. This is a precise way to find login pages on administrative interfaces, as it targets URLs containing both terms, which is a common pattern for admin login portals.

Exam trap

The trap here is that candidates often choose `intitle:"login" inurl:admin` (Option C) thinking it's more comprehensive, but they overlook that many admin login pages do not have 'login' in the HTML title tag, making the `intitle:` operator too restrictive for this specific goal.

How to eliminate wrong answers

Option A is wrong because `site:admin login` is not a valid Google dork; `site:` requires a domain name, not a keyword, and 'admin login' as a search phrase would just match pages containing those words anywhere, not specifically in the URL. Option B is wrong because `filetype:pdf admin login` restricts results to PDF files, which is irrelevant for finding login pages (typically HTML/ASPX/PHP), and the terms 'admin' and 'login' are searched in the page content, not the URL. Option C is wrong because `intitle:"login" inurl:admin` searches for pages with 'login' in the title and 'admin' in the URL, but this misses pages where 'login' is only in the URL (not the title), which is common for many admin login pages.

Practice this question →
70
MCQmedium

During a reconnaissance phase, a tester uses `dnsrecon -d example.com -t axfr`. What specific DNS query is being attempted?

A.A subdomain brute-force
B.A zone transfer request
C.A reverse DNS lookup
D.A SRV record enumeration
AnswerB

When dnsrecon is executed with only the domain specified, such as dnsrecon -d example.com, its default behavior is to attempt a DNS zone transfer (AXFR). This process requests a full copy of the DNS zone file from the authoritative name server. If the server is misconfigured to allow unauthorized zone transfers, the tester can obtain a comprehensive list of all hostnames, IP addresses, and other DNS records for the domain, providing extensive reconnaissance data.

Why this answer

The `-t axfr` flag in `dnsrecon` specifies a zone transfer request (AXFR). This query attempts to retrieve the entire DNS zone file from a nameserver, which can reveal all DNS records for the domain. A successful zone transfer is a critical misconfiguration because it exposes internal network topology and hostnames.

Exam trap

The trap here is that candidates may confuse `-t axfr` with other reconnaissance techniques like brute-forcing or record enumeration, but the CEH exam specifically tests the exact command flag for zone transfers.

How to eliminate wrong answers

Option A is wrong because a subdomain brute-force uses a wordlist to guess subdomains, not the AXFR query type. Option C is wrong because a reverse DNS lookup queries an IP address for a PTR record, not a domain for a zone transfer. Option D is wrong because SRV record enumeration uses the `-t srv` flag or similar, not `-t axfr`, which is specific to zone transfers.

Practice this question →
71
MCQmedium

Which Google dork query would an attacker most likely use to find login pages on a web server?

A.inurl:admin
B.intitle:login
C.site:example.com filetype:pdf
D.link:example.com
AnswerB

The intitle:login Google Dork is highly effective for pinpointing potential login pages because web developers commonly include "login" or "sign in" within the HTML <title> tag of authentication portals. This query directly targets the descriptive title of a page, significantly increasing the likelihood of identifying an actual user authentication interface rather than general administrative content or unrelated pages. It provides a direct indicator of a page designed for user credential submission.

Why this answer

The Google dork 'intitle:login' specifically searches for web pages where the word 'login' appears in the HTML title tag. Attackers use this to quickly discover login portals, as many web applications include 'login' in the page title, making it a reliable footprinting technique for identifying authentication interfaces.

Exam trap

The trap here is that candidates often confuse 'inurl:admin' with login page discovery, but 'admin' in the URL typically points to administrative backends rather than user login portals, which are more commonly identified by the title tag containing 'login'.

How to eliminate wrong answers

Option A is wrong because 'inurl:admin' searches for URLs containing 'admin', which may return admin panels or directories but is less specific to login pages and often yields broader results like admin dashboards or configuration pages. Option C is wrong because 'site:example.com filetype:pdf' restricts results to PDF files on a specific domain, which is useful for document discovery but not for finding login pages. Option D is wrong because 'link:example.com' is a deprecated Google operator that lists pages linking to a given URL, not a method for locating login pages on the target server.

Practice this question →
72
MCQmedium

During a penetration test, you execute a DNS zone transfer request against a target domain and succeed. Which type of DNS record would you expect to reveal the mail servers for the domain?

A.CNAME record
B.MX record
C.A record
D.NS record
AnswerB

An MX (Mail Exchanger) record specifies the mail servers responsible for accepting email messages on behalf of a domain, along with their preference values. During a DNS zone transfer, obtaining MX records provides highly valuable intelligence about an organization's email infrastructure, including the hostnames and sometimes internal IP addresses of their mail servers. This information is critical for penetration testers, as it identifies prime targets for email-based attacks, spoofing, or further reconnaissance against mail gateways and associated systems.

Why this answer

An MX (Mail Exchange) record is the DNS record type that specifies the mail servers responsible for accepting email messages on behalf of a domain. During a successful DNS zone transfer, the full zone file is retrieved, and MX records are included, directly revealing the domain's mail server hostnames and priority values.

Exam trap

EC-Council often tests the distinction between record types by making candidates confuse the purpose of an MX record with an A record or CNAME, especially when the question involves identifying services rather than simple hostname resolution.

How to eliminate wrong answers

Option A is wrong because a CNAME (Canonical Name) record is an alias that maps one domain name to another, not a record that directly identifies mail servers. Option C is wrong because an A (Address) record maps a hostname to an IPv4 address; while it could resolve a mail server's hostname to an IP, it does not itself designate which servers handle mail for the domain. Option D is wrong because an NS (Name Server) record delegates a zone to authoritative name servers, not mail servers.

Practice this question →
73
MCQmedium

While performing reconnaissance, a tester uses a Google dork to find login pages exposed on the internet. Which of the following is an example of a Google dork that could be used for this purpose?

A.inurl:login.php
B.site:example.com -www
C.filetype:pdf
D.link:example.com
AnswerA

This dork finds URLs containing 'login.php'.

Why this answer

The Google dork 'inurl:login.php' instructs Google to return only URLs that contain the string 'login.php' in the URL path. This is a classic reconnaissance technique to discover exposed login pages, as many web applications use 'login.php' as the default authentication endpoint. The 'inurl:' operator filters search results based on the literal text in the URL, making it ideal for footprinting specific web resources.

Exam trap

EC-Council often tests the distinction between operators that search URL content ('inurl:') versus page content ('intitle:') or file types ('filetype:'), leading candidates to confuse 'filetype:pdf' as a valid dork for finding login pages when it actually targets document files.

How to eliminate wrong answers

Option B is wrong because 'site:example.com -www' restricts results to the domain 'example.com' while excluding subdomains containing 'www', which is useful for narrowing scope but does not specifically target login pages. Option C is wrong because 'filetype:pdf' limits results to PDF files, which are documents, not interactive login pages; it is used for finding documents, not web application endpoints. Option D is wrong because 'link:example.com' is a deprecated Google operator that used to find pages linking to a specific URL; it does not search for login pages and is no longer supported by Google.

Practice this question →
74
MCQeasy

What is the primary purpose of using the Nmap flag -sS?

A.Enable OS detection
B.Perform a SYN stealth scan
C.Perform a UDP scan
D.Perform a TCP connect scan
AnswerB

The -sS flag instructs Nmap to perform a SYN stealth scan, also known as a half-open scan. This method sends a SYN packet to the target port; if a SYN/ACK is received, Nmap knows the port is open but does not complete the three-way handshake by sending an ACK. This technique often bypasses non-stateful firewalls and avoids full connection logs on the target system, making it less detectable than a full TCP connect scan.

Why this answer

The Nmap flag -sS instructs Nmap to perform a SYN stealth scan, also known as a half-open scan. It sends a TCP SYN packet to the target port and, if a SYN/ACK is received, the port is considered open; the scanner then sends a RST to tear down the connection before the full TCP three-way handshake completes. This technique avoids completing the connection, making it less likely to be logged by the target's application layer and is the default scan type when run with root privileges.

Exam trap

EC-Council often tests the distinction between -sS (SYN stealth) and -sT (TCP connect), where candidates mistakenly think -sS completes the handshake or that -sT is the stealthier option.

How to eliminate wrong answers

Option A is wrong because OS detection is enabled with the -O flag, not -sS. Option C is wrong because a UDP scan is performed using the -sU flag, which sends UDP packets to target ports. Option D is wrong because a TCP connect scan uses the -sT flag, which completes the full three-way handshake using the operating system's connect() system call, unlike the half-open SYN scan.

Practice this question →
75
MCQeasy

A penetration tester uses theHarvester to gather information about a target domain. Which of the following data types is theHarvester PRIMARILY designed to collect?

A.Live network traffic captures
B.Passwords hashes
C.Email addresses and subdomains
D.Vulnerability scan results
AnswerC

Its primary purpose is to gather emails and subdomains associated with a domain.

Why this answer

theHarvester is an open-source intelligence (OSINT) tool designed to perform passive reconnaissance by querying public sources such as search engines (Google, Bing), PGP key servers, and the Shodan API. Its primary function is to collect email addresses, subdomains, IP addresses, and virtual hosts associated with a target domain, aiding in the footprinting phase of a penetration test.

Exam trap

The trap here is that candidates confuse theHarvester's passive OSINT collection with active scanning or exploitation tools, leading them to select options related to network traffic, password cracking, or vulnerability scanning.

How to eliminate wrong answers

Option A is wrong because theHarvester does not capture live network traffic; that is the function of packet sniffers like tcpdump or Wireshark, which operate at the data-link layer. Option B is wrong because theHarvester does not extract password hashes; hash retrieval is typically performed by tools like Hashcat or John the Ripper after obtaining a password database dump. Option D is wrong because theHarvester does not perform vulnerability scanning; vulnerability assessment is done by tools like Nessus or OpenVAS, which actively probe services for known CVEs.

Practice this question →
Page 1 of 2 · 140 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Footprinting, Reconnaissance and Scanning questions.

Start 20-question session