CEH Footprinting, Reconnaissance and Scanning Practice Question
During a penetration test, you run the following command: hping3 -S -p 80 --flood 192.168.1.100. What is the PRIMARY purpose of this command?
⚠ Common exam trap
Many exam-takers confuse a SYN flood DoS attack with a SYN scan (port scanning), but the `--flood` flag explicitly indicates a denial-of-service intent, not reconnaissance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Execute a denial-of-service (DoS) attack against the target's web server
The command `hping3 -S -p 80 --flood 192.168.1.100` sends a high volume of TCP SYN packets to port 80 of the target without completing the three-way handshake. The `--flood` flag disables packet rate limiting, causing a rapid stream of SYN packets that exhausts the target's connection queue, effectively performing a SYN flood denial-of-service (DoS) attack against the web server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Banner grab the HTTP service on port 80
Why it's wrong here
A SYN flood does not establish a full TCP connection, which is a prerequisite for sending application-layer requests like HTTP GET to retrieve a banner. The command only sends initial SYN packets, never completing the handshake or transmitting data that would elicit a banner response from the web server. Therefore, no banner information can be retrieved.
- ✗
Fingerprint the operating system of the target
Why it's wrong here
Operating system fingerprinting relies on analyzing specific characteristics of TCP/IP responses, such as initial window sizes, TTL values, and flag combinations in SYN-ACK or RST packets. The `--flood` option in hping3 explicitly instructs the tool to send packets without waiting for or processing any replies, thereby preventing the collection of necessary response data for OS identification.
- ✗
Perform a TCP connect scan to identify open ports
Why it's wrong here
A TCP connect scan, or even a SYN scan, requires the attacker to analyze the target's responses (e.g., SYN-ACK for open ports, RST for closed ports) to determine port status. The `--flood` option, however, is designed to rapidly send an overwhelming number of packets without processing replies, making it unsuitable for the analytical process of identifying open ports.
- ✓
Execute a denial-of-service (DoS) attack against the target's web server
Why this is correct
The command `hping3 -S --flood -p 80 <target_ip>` is specifically engineered to launch a SYN flood denial-of-service attack. By rapidly sending a massive volume of TCP SYN packets to port 80, the target's web server is forced to allocate resources for numerous half-open connections. This quickly exhausts the server's connection queue, preventing legitimate users from establishing new connections and effectively denying service.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.