CEH Footprinting, Reconnaissance and Scanning Practice Question
During a security assessment, a tester uses `nmap -sU 192.168.1.1`. What type of scan does this command perform?
⚠ Common exam trap
Test-takers frequently confuse the `-sU` flag with a TCP SYN scan (`-sS`) or assume it performs a general host discovery, but the question specifically tests knowledge of Nmap's scan type flags.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
UDP scan
The `-sU` flag in Nmap explicitly instructs the tool to perform a UDP scan. This sends UDP packets to the target ports and analyzes responses (or lack thereof) to determine if a UDP port is open, closed, or filtered. Unlike TCP, UDP is connectionless, so the scan relies on ICMP unreachable messages or lack of response to infer port status.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
UDP scan
Why this is correct
The `nmap -sU` command explicitly instructs Nmap to perform a UDP scan, which is the correct interpretation of the provided syntax. This method sends UDP packets to target ports and analyzes the responses (or lack thereof) to determine if a port is open, closed, or filtered. Unlike TCP, UDP is connectionless, making port state determination more challenging and often slower, as open ports may not send a response, while closed ports typically return an ICMP Port Unreachable message.
- ✗
TCP SYN scan
Why it's wrong here
A TCP SYN scan, also known as a "half-open" scan, is initiated using the `-sS` flag in Nmap, not `-sU`. This technique sends a SYN packet to the target port and observes if a SYN/ACK response is received, indicating an open port, without completing the three-way handshake. The command `nmap -sU` specifically targets UDP services, not TCP, and therefore would not perform a TCP SYN scan.
- ✗
Ping sweep
Why it's wrong here
A ping sweep, or host discovery scan, is performed with the `-sn` (or `-sP` in older versions) flag in Nmap. Its primary purpose is to determine which hosts are online within a specified network range by sending ICMP echo requests or other packets. The `nmap -sU` command, however, is designed for scanning specific UDP ports on a target, not for broadly identifying active hosts across an entire subnet.
- ✗
OS fingerprinting
Why it's wrong here
OS fingerprinting is achieved in Nmap by using the `-O` flag, which attempts to determine the operating system and device type of the target host. This process involves sending a series of TCP and UDP packets and analyzing the responses, including TCP initial sequence numbers, window sizes, and various ICMP error messages. The `nmap -sU` command exclusively focuses on scanning UDP ports and does not incorporate the specialized probes required for accurate OS detection.
Visual reference
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.