CCNA Scanning Networks and Enumeration Questions

MCQmedium

A penetration tester discovers that an Nmap SYN scan against a target host returns no open ports, but a TCP connect scan reveals port 443 open. Which of the following is the most likely reason for this discrepancy?

A.The target host has a host-based firewall that drops SYN packets but allows full connections.

B.A network firewall is performing stateful inspection and dropping unsolicited SYN packets while allowing established connections.

C.The target host has ICMP filtering enabled, preventing Nmap from identifying it as online.

D.Nmap's SYN scan requires root privileges, and the tester ran it without sudo.

AnswerB

Stateful firewalls track connections; a SYN scan sends unsolicited SYN packets that may be dropped, while a connect scan completes the handshake and appears as a normal connection.

Why this answer

The discrepancy occurs because a network firewall is performing stateful inspection. It drops unsolicited SYN packets (the first step of a SYN scan) but allows full TCP connections (SYN, SYN-ACK, ACK) to complete, as the connect scan establishes a full three-way handshake. This behavior is typical of stateful firewalls that track connection state and only permit packets belonging to established sessions.

Exam trap

The trap here is that candidates often assume a host-based firewall is the cause, but stateful network firewalls specifically differentiate between incomplete SYN probes and full TCP handshakes, making option B the correct answer.

How to eliminate wrong answers

Option A is wrong because a host-based firewall would typically block both SYN packets and full connection attempts consistently, not selectively allow full connections while dropping SYNs. Option C is wrong because ICMP filtering affects host discovery (ping sweeps), not port scan results; Nmap can still perform port scans without ICMP echo replies. Option D is wrong because while SYN scan requires root privileges, running without sudo would cause an error or fallback to connect scan, not produce a discrepancy between two scans—both would fail or both would show open ports.

Practice this question →

MCQmedium

Refer to the exhibit. An Nmap scan shows that port 80 is 'filtered' while ports 22 and 443 are 'open'. What does the 'filtered' state indicate?

A.The port is closed and the target sent a RST packet.

B.The port is open but the service is not responding to the scan.

C.The port is open but Nmap cannot determine the service.

D.A firewall, router rule, or host-based firewall is blocking the probes.

AnswerD

When Nmap reports a port as 'filtered', it signifies that the TCP or UDP probes sent to that port did not elicit any response from the target host. This behavior is characteristic of network security devices, such as firewalls (both network-based and host-based) or routers configured with Access Control Lists (ACLs), which are designed to silently drop incoming packets that do not match allowed rules. The probes are effectively absorbed into a "black hole," preventing Nmap from determining the true state of the port.

Why this answer

When Nmap reports a port as 'filtered', it means that the scan probes (e.g., SYN packets) were dropped or blocked before reaching the target service, typically by a firewall, router ACL, or host-based firewall. Unlike 'open' (which receives a SYN/ACK) or 'closed' (which receives a RST), 'filtered' indicates no response or an ICMP unreachable message, so Nmap cannot confirm whether the port is actually open or closed.

Exam trap

The trap here is that candidates often confuse 'filtered' with 'closed' or 'open', not realizing that 'filtered' specifically indicates a firewall or ACL is interfering with the probe, not the state of the service itself.

How to eliminate wrong answers

Option A is wrong because a closed port sends a RST packet in response to a SYN scan, which Nmap reports as 'closed', not 'filtered'. Option B is wrong because if a port is open but the service is not responding, Nmap would still receive a SYN/ACK from the TCP stack (since the OS handles the handshake), and the port would be reported as 'open' unless a firewall interferes. Option C is wrong because Nmap can determine the service on an open port via service version detection (-sV); 'filtered' does not relate to service identification failure.

Practice this question →

MCQmedium

A network administrator needs to identify all devices on a large corporate network that are running a specific vulnerable version of OpenSSH. The administrator has network access and can use scanning tools. However, scanning the entire network might disrupt operations. Which approach minimizes disruption while accurately identifying the vulnerable hosts?

A.Conduct a full TCP port scan of the entire network using SYN scan.

B.Run a TCP SYN scan on port 22 only, with version detection enabled, across the target IP range.

C.Use a ping sweep to identify live hosts, then perform a version scan on each.

D.Perform an ARP scan of the entire subnet and then check each host manually.

AnswerB

This approach is highly efficient and targeted for identifying devices running a specific service. A TCP SYN scan on port 22 (SSH) across the target IP range quickly identifies hosts listening on this port without establishing a full connection, thus minimizing network overhead and remaining relatively stealthy. Enabling version detection simultaneously gathers crucial information about the SSH service's software version, which is essential for identifying potential vulnerabilities without further extensive scanning.

Why this answer

It targets only TCP port 22 (the default SSH port) with a SYN scan, which is stealthier and faster than a full connect scan, and enables version detection to identify the specific vulnerable OpenSSH version. This minimizes disruption by avoiding scanning unnecessary ports and reduces network load, while accurately pinpointing vulnerable hosts.

Exam trap

The trap here is that candidates often choose a ping sweep (Option C) thinking it reduces disruption, but they overlook that ICMP may be blocked, and the subsequent version scan on each host still requires port-level scanning, making Option B more efficient and accurate.

How to eliminate wrong answers

Option A is wrong because a full TCP port scan of the entire network would generate excessive traffic, potentially disrupting operations, and is unnecessary when only port 22 is relevant. Option C is wrong because a ping sweep may miss hosts that block ICMP (e.g., firewalls), leading to incomplete identification, and then performing a version scan on each live host still requires scanning all ports on those hosts, which is less efficient than targeting port 22 directly. Option D is wrong because an ARP scan only works within the local subnet (Layer 2) and does not scale to a large corporate network across multiple subnets; manual checking is impractical and error-prone.

Practice this question →

MCQeasy

You are conducting a security assessment and need to map the network topology and identify routers, firewalls, and other network devices. Which technique is specifically designed to discover the path packets take to reach a destination and can reveal intermediate devices?

A.Traceroute

B.Banner grabbing

C.DNS enumeration

D.SNMP walk

AnswerA

Traceroute is a fundamental network diagnostic tool that maps the path a packet takes to reach a destination by strategically manipulating the IP packet's Time To Live (TTL) field. It sends a series of packets, starting with a TTL of 1 and incrementing it, causing intermediate routers to decrement the TTL to zero and respond with an ICMP Time Exceeded message. Each ICMP response reveals an intermediate router (hop), effectively tracing the full network path hop-by-hop and identifying the sequence of devices. This method is precisely designed for network topology discovery.

Why this answer

Traceroute is the correct technique because it is specifically designed to map the path packets take from a source to a destination by manipulating the Time-to-Live (TTL) field in IP headers. As each hop decrements the TTL, routers along the path send ICMP Time Exceeded messages (or UDP responses in some implementations), revealing their IP addresses and thus identifying intermediate devices like routers and firewalls.

Exam trap

The trap here is that candidates often confuse traceroute with ping (which only tests reachability and RTT, not hop-by-hop path discovery) or assume banner grabbing can reveal network topology, but only traceroute systematically identifies each intermediate device along the route.

How to eliminate wrong answers

Option B is wrong because banner grabbing is used to retrieve service banners (e.g., HTTP Server header, SSH version) from open ports to identify running services and versions, not to discover network path or intermediate devices. Option C is wrong because DNS enumeration is a technique to gather DNS records (e.g., A, MX, NS) and subdomains from a DNS server to map domain infrastructure, not to trace packet routes. Option D is wrong because an SNMP walk retrieves the entire Management Information Base (MIB) tree from an SNMP-enabled device to read configuration and performance data, not to discover the path packets take through the network.

Practice this question →

MCQhard

During an internal penetration test, you are tasked with enumerating services on a target server. You run a full TCP port scan and find that ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) are open. You then perform version detection on these ports. Which additional enumeration step would provide the most valuable information for identifying potential vulnerabilities?

A.Perform banner grabbing on port 22 to identify the SSH version.

B.Perform SNMP enumeration to gather system information.

C.Attempt a DNS zone transfer from the server.

D.Enumerate NetBIOS names using `nbtstat`.

AnswerA

Banner grabbing on port 22, typically used for SSH, is a fundamental reconnaissance technique. By connecting to the port and observing the initial response, an attacker can identify the specific SSH server software and its version number. This version information is crucial for cross-referencing against public vulnerability databases (e.g., CVEs) to discover known exploits, potentially leading to unauthorized access or privilege escalation if an outdated or misconfigured version is in use.

Why this answer

Banner grabbing on port 22 (SSH) is the most valuable next step because it directly identifies the SSH server version (e.g., OpenSSH 7.4). Knowing the exact version allows you to cross-reference known vulnerabilities (CVEs) for that specific SSH implementation, which is a common high-risk attack vector during internal penetration tests. While version detection already identified the service, banner grabbing can reveal additional details like patch levels or configuration quirks that version detection might miss.

Exam trap

EC-Council often tests the misconception that SNMP, DNS zone transfers, or NetBIOS enumeration are universally applicable, but the trap here is that these techniques only work when the corresponding services are actually running and accessible — the question explicitly limits open ports to 22, 80, and 443, so only banner grabbing on those ports is directly actionable.

How to eliminate wrong answers

Option B is wrong because SNMP enumeration requires SNMP (UDP ports 161/162) to be open, and the scan only found TCP ports 22, 80, and 443 — no SNMP service was detected, so this step would fail or provide no useful data. Option C is wrong because DNS zone transfer requires a DNS server (typically port 53) to be present and configured to allow transfers; the target server does not have DNS open, so this attempt would be irrelevant. Option D is wrong because NetBIOS enumeration (using nbtstat) relies on NetBIOS over TCP/IP (ports 137-139, 445), which are not open on the target; this technique is only applicable to Windows systems with NetBIOS enabled, not to a server with only SSH, HTTP, and HTTPS.

Practice this question →

Matchingmedium

Match each security tool to its primary purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Network scanning and enumeration

Packet capture and analysis

Exploitation framework

Password cracking

Web application security testing

Why these pairings

The correct matches are: Nmap for network scanning, Wireshark for packet analysis, Metasploit for exploitation, and Burp Suite for web app testing. Common confusions arise from swapping definitions between tools with overlapping functionalities.

Practice this question →

Drag & Dropmedium

Drag and drop the steps to conduct a penetration test using the CEH methodology into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The CEH methodology follows: Reconnaissance, Scanning, Gaining Access, Maintaining Access, Covering Tracks.

Practice this question →

MCQhard

You are a penetration tester for a financial institution. During the reconnaissance phase, you discover that the target network uses a firewall that only allows inbound TCP connections on ports 80, 443, and 8080. You need to identify live hosts and running services on the internal network (192.168.1.0/24) from an external perspective. To avoid detection, you must minimize the number of packets sent and ensure that your scanning technique does not complete the TCP three-way handshake. Additionally, you have limited time and need to scan all 65535 ports on the most promising target. Based on the firewall rules and the need for stealth, which of the following approaches should you take?

A.Perform a TCP connect scan (-sT) on all ports of the subnet to identify open ports and services.

B.Perform an Xmas scan (-sX) on all ports of the subnet to evade detection by sending packets with invalid flag combinations.

C.First, perform a TCP SYN scan (-sS) on the three allowed ports across the subnet. Once a live host is identified, perform a TCP SYN scan (-sS) on all 65535 ports of that host.

D.Perform a UDP scan (-sU) on all ports of the subnet because UDP is connectionless and less likely to be logged.

AnswerC

The TCP SYN scan (-sS), also known as a "half-open" scan, is highly effective and stealthy because it initiates a TCP handshake but does not complete it. It sends a SYN packet and, upon receiving a SYN/ACK, immediately sends an RST, preventing full connection logging. This two-phase approach is optimal: initially scanning only the three known allowed ports across the subnet efficiently identifies active hosts, then a comprehensive SYN scan on all 65535 ports of *only* the live hosts provides a detailed service map while minimizing overall network footprint and detection risk.

Why this answer

A TCP SYN scan (-sS) sends only a SYN packet and does not complete the three-way handshake, making it stealthy. First scanning only the three allowed ports (80, 443, 8080) across the subnet minimizes packets and identifies live hosts. Once a promising target is found, a full SYN scan on all 65535 ports efficiently maps services while evading the firewall's restrictions.

Exam trap

The trap here is that candidates may choose an Xmas scan (Option B) thinking it is stealthy due to invalid flags, but fail to realize that modern firewalls and IDS systems easily detect and drop such anomalous packets, making it ineffective against port-based allow rules.

How to eliminate wrong answers

Option A is wrong because a TCP connect scan (-sT) completes the full three-way handshake, generating more packets and logs, which increases detection risk and violates the requirement to avoid completing the handshake. Option B is wrong because an Xmas scan (-sX) sends packets with FIN, URG, and PSH flags set, which many firewalls and intrusion detection systems (IDS) drop or log as anomalous; it is also ineffective against firewalls that only allow specific TCP ports (80, 443, 8080) and may not elicit responses from filtered ports. Option D is wrong because a UDP scan (-sU) is connectionless but is slow, unreliable, and often blocked or rate-limited by firewalls; it does not leverage the allowed TCP ports and would generate excessive packets without stealth benefits.

Practice this question →

MCQeasy

Refer to the exhibit. A penetration tester runs the above Nmap scan. Which of the following statements is most accurate regarding the state of port 3389?

A.Port 3389 is open and running a Remote Desktop service, but the service version could not be identified.

B.Port 3389 is closed and the target is ignoring the probe.

C.The target is likely a honeypot designed to simulate a Windows machine.

D.A firewall is likely blocking the scan probes to port 3389, preventing Nmap from determining whether the port is open.

AnswerD

The 'filtered' state in Nmap output precisely indicates that Nmap was unable to ascertain whether a port is open or closed because its probes did not elicit a response. This condition commonly arises when a firewall or other packet filtering device is actively dropping or rejecting the scan packets directed at port 3389, thereby preventing Nmap from completing its state determination process. This is the most accurate interpretation of a 'filtered' port, signifying an unknown state due to network obstruction.

Why this answer

The Nmap scan output shows port 3389 in a 'filtered' state, which means Nmap received no response or an ICMP unreachable error from the target. This typically indicates a firewall is blocking the probes, preventing Nmap from determining whether the port is actually open or closed. A filtered state does not confirm the port is open or closed, only that access is being obstructed.

Exam trap

The trap here is that candidates confuse 'filtered' with 'closed' or 'open', failing to recognize that Nmap's port states (open, closed, filtered) have distinct meanings based on the type of response received, and that a firewall can cause a filtered state without revealing whether the service is actually running.

How to eliminate wrong answers

Option A is wrong because Nmap reports port 3389 as 'filtered', not 'open', so it cannot confirm the service is running or identify its version. Option B is wrong because a 'closed' port would return a TCP RST packet, not the lack of response or ICMP unreachable that defines the 'filtered' state. Option C is wrong because a honeypot would typically respond to probes to simulate a service, not remain silent or return ICMP unreachables; the 'filtered' state does not indicate deception, only network-level filtering.

Practice this question →

MCQhard

You are a penetration tester assessing a client's internal network. The client has provided you with a non-administrative domain user account. The target network consists of 200 Windows workstations and 5 Windows servers (one domain controller, one file server, two application servers, and one database server). All systems are fully patched and have host-based firewalls enabled. The client wants you to identify vulnerabilities that could be exploited from the internal network. After initial reconnaissance, you discover that all servers have SMB (port 445) open only to the domain controller and the file server has SMB open to all workstations. You have gained a foothold on a workstation via a phishing attack. From this workstation, you can reach the file server on port 445. What is the most effective next step to enumerate potential vulnerabilities on the file server?

A.Attempt to connect to the file server via RDP (port 3389) using the compromised user's credentials.

B.Use PsExec to execute commands remotely on the file server using the compromised user account.

C.Run a full vulnerability scan (e.g., Nessus) against the entire subnet to identify weaknesses.

D.Enumerate SMB shares and session information using `net view \\fileserver` and `smbclient -L //fileserver`.

AnswerD

Enumerating SMB shares and session information using `net view \\fileserver` (on Windows) or `smbclient -L //fileserver` (on Linux/Kali) is a highly effective and low-impact reconnaissance method. These commands leverage the Server Message Block (SMB) protocol, the file server's core service, to list accessible shares and potential misconfigurations like null sessions. This approach directly targets the server's primary function and is designed to work even with standard user permissions, providing valuable insights into accessible resources.

Why this answer

The client's objective is to enumerate potential vulnerabilities on the file server from the compromised workstation. Since SMB (port 445) is open between workstations and the file server, using `net view \\fileserver` and `smbclient -L //fileserver` allows you to list SMB shares, sessions, and other information without requiring administrative privileges or additional tools. This is a standard enumeration technique that reveals accessible resources, which can then be tested for misconfigurations or weak permissions.

Exam trap

The trap here is that candidates often assume a full vulnerability scan (Option C) is always the best next step, but in a stealthy penetration test with limited credentials, targeted SMB enumeration (Option D) is more effective and less likely to be detected.

How to eliminate wrong answers

Option A is wrong because RDP (port 3389) is not mentioned as open on the file server, and even if it were, connecting via RDP with a non-administrative user would not provide the necessary enumeration of SMB-based vulnerabilities. Option B is wrong because PsExec requires administrative privileges on the target system, and the compromised user is non-administrative, so the command would fail. Option C is wrong because running a full vulnerability scan (e.g., Nessus) against the entire subnet is noisy, time-consuming, and may trigger alerts; the question asks for the most effective next step after initial reconnaissance, and targeted SMB enumeration is more appropriate.

Practice this question →

Drag & Dropmedium

Drag and drop the steps to perform a buffer overflow exploit in a controlled lab environment into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Identify vulnerability, find offset, generate shellcode, craft exploit, execute.

Practice this question →

Multi-Selectmedium

Which THREE Nmap options are commonly used to evade firewall detection during a scan? (Choose three.)

Select 3 answers

A.-f (fragment packets)

B.-T0 (paranoid timing)

C.-D (decoy)

D.-sT (TCP connect scan)

E.-sV (version detection)

AnswersA, B, C

The -f option instructs Nmap to fragment the IP packets into smaller, non-standard-sized pieces. This technique can bypass stateless firewalls or Intrusion Detection Systems (IDS) that only inspect the initial fragments, as critical header information (like TCP flags or port numbers) might be split across multiple segments. When the fragmented packets reach the target, the operating system reassembles them before processing, potentially allowing the scan to proceed undetected by intermediate network devices.

Why this answer

The -f flag fragments the IP packets into smaller pieces (typically 8-byte fragments) to bypass simple packet-filtering firewalls and intrusion detection systems that do not reassemble fragmented packets before applying filtering rules. This technique exploits the fact that many stateless firewalls only inspect the first fragment and allow subsequent fragments through unchecked, enabling the scan to reach the target.

Exam trap

The trap here is that candidates often mistake -sT (TCP connect scan) as a stealthy option because it is the default scan type, but it actually completes the full handshake and is highly detectable, whereas the correct evasion options focus on fragmentation, timing, and decoys.

Practice this question →

Multi-Selecthard

Which TWO types of information can be obtained through SNMP enumeration on a target device if the community string is 'public'? (Choose two.)

Select 2 answers

A.List of running processes

B.Captured network packets

C.User account passwords

D.Modify network interface settings

E.Routing table entries

AnswersA, E

SNMP agents can provide a comprehensive list of running processes on a managed device. This information is typically found within the Host Resources MIB (RFC 2790), specifically by querying objects like `hrSWRunTable`. This table contains details such as process ID, name, path, and current status, which is crucial for system monitoring and troubleshooting.

Why this answer

SNMP enumeration with the default 'public' community string (read-only access) allows querying MIB objects that expose system information. The 'hostResources' MIB (RFC 2790) includes the 'hrSWRunTable', which lists running processes, and the 'ipRouteTable' (RFC 1213) provides routing table entries. These are standard read-only OIDs accessible without authentication.

Exam trap

The trap here is that candidates confuse the 'public' community string with full administrative access, assuming it can modify settings or retrieve sensitive data like passwords, when in fact it only provides read-only access to non-sensitive MIB objects.

Practice this question →