CEH Footprinting, Reconnaissance and Scanning Practice Question
During a penetration test, you run the following command: nmap -sV -p 80 --script http-title 192.168.1.10. The output shows that port 80 is open and the HTTP title is 'Login Portal'. Which phase of the penetration testing methodology does this activity represent?
⚠ Common exam trap
EC-Council often tests the distinction between footprinting and scanning/enumeration, where candidates mistakenly classify any information-gathering activity as footprinting, but the key differentiator is whether the activity involves direct interaction with the target system (scanning) versus passive collection (footprinting).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Scanning and enumeration
The nmap command with -sV (service version detection) and --script http-title performs service fingerprinting and banner grabbing on port 80, which is a core activity of the scanning and enumeration phase. This phase follows footprinting and involves actively probing target systems to discover open ports, running services, and application details like the HTTP title 'Login Portal'. It does not involve exploiting vulnerabilities (exploitation) or maintaining access (post-exploitation), nor is it passive information gathering (footprinting).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Exploitation
Why it's wrong here
Exploitation is the phase where identified vulnerabilities are actively leveraged to gain unauthorized access, elevate privileges, or execute arbitrary code on a target system. Running an nmap command, which is primarily a reconnaissance and discovery tool, merely gathers information about network services and open ports. It does not, by itself, involve the actual compromise or manipulation of a system's security flaws to achieve control.
- ✗
Post-exploitation
Why it's wrong here
Post-exploitation activities occur strictly after an attacker has successfully gained initial access to a target system. This phase involves actions like maintaining persistence, escalating privileges, exfiltrating data, and pivoting to other systems within the network. An nmap scan, however, is a pre-access activity focused on initial network discovery and service identification, preceding any actual compromise or subsequent actions within the compromised environment.
- ✗
Footprinting
Why it's wrong here
Footprinting is the initial, often passive, information gathering phase where an attacker collects publicly available data about a target without direct interaction with its systems. This typically involves techniques such as OSINT, WHOIS lookups, DNS queries, and social media analysis. In contrast, an nmap command actively sends packets to a target network or host, directly probing for live hosts, open ports, and service banners, making it an active reconnaissance method.
- ✓
Scanning and enumeration
Why this is correct
Scanning and enumeration is the phase where an attacker actively probes target systems to identify live hosts, open ports, running services, operating system types, and potential vulnerabilities. The nmap command is a quintessential tool for this phase, as it systematically sends various types of packets to map out the network landscape and gather detailed information about network services. This active interaction provides the crucial intelligence needed to identify potential entry points for subsequent exploitation attempts.
Go deeper
Related to this question
Learn chapter
Footprinting and Reconnaissance
Key term
Active reconnaissance
Active reconnaissance is the process of directly interacting with a target system or network to gather information, often through scanning and probing.
Key term
Persistence Mechanisms
Techniques used by attackers to maintain long-term access to a compromised system after an initial breach.
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.