CEH Footprinting, Reconnaissance and Scanning Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The server is using a reverse proxy that presents a different version to Nmap

  Why it's wrong here

  A reverse proxy sits in front of a backend server, presenting a unified interface. If Nmap and Netcat connect to the same target IP address, they are both interacting with the proxy itself. Therefore, if a proxy were presenting a specific version, both tools would observe that same version from the proxy. A discrepancy between Nmap's version detection and Netcat's direct banner grab indicates a difference in their detection methodologies, not that the proxy is selectively presenting different information to different tools connecting to the same endpoint.

• ✓

  Netcat banner grabbing is more reliable because it reads the actual server response

  Why this is correct

  Netcat performs a direct banner grab by establishing a raw TCP connection to the target port and simply displaying the initial data sent by the service. This method directly reads the service's self-reported version string, which is typically the most authoritative source. In contrast, Nmap's -sV (service version detection) relies on a database of signatures and probes, which can sometimes be outdated, incomplete, or misinterpret non-standard banners, leading to discrepancies compared to the service's actual response.

• ✗

  The discrepancy is due to Nmap's OS fingerprinting conflicting with version detection

  Why it's wrong here

  Nmap's OS fingerprinting (-O) and service version detection (-sV) are distinct and independent modules within Nmap. OS fingerprinting attempts to identify the operating system based on TCP/IP stack characteristics, while service version detection probes specific ports to identify application versions. These two processes operate separately and do not inherently conflict or influence each other's results, meaning a discrepancy in service version detection would not be caused by OS fingerprinting.

• ✗

  Nmap is more accurate because it uses deep packet inspection

  Why it's wrong here

  While Nmap's service detection (-sV) employs various sophisticated probes and signature matching, often going beyond simple banner grabs, it does not typically perform "deep packet inspection" in the sense of analyzing application-layer protocol intricacies to determine versions. Netcat, by directly establishing a connection and reading the initial service banner, captures the server's explicit self-identification. For directly reported version strings, this raw banner grab is often more accurate than Nmap's heuristic-based signature matching, which can sometimes misidentify services or provide generic results.

Go deeper

Related to this question