How should I use these Footprinting, Reconnaissance and Scanning practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

CEH · topic practice

Footprinting, Reconnaissance and Scanning practice questions

Q: Can I practise just Footprinting, Reconnaissance and Scanning questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Footprinting, Reconnaissance and Scanning domain.

Practise Certified Ethical Hacker CEH Footprinting, Reconnaissance and Scanning practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Footprinting, Reconnaissance and Scanning

Practice 10 questions Browse domain →

What the exam tests

What to know about Footprinting, Reconnaissance and Scanning

Footprinting, Reconnaissance and Scanning questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Footprinting, Reconnaissance and Scanning exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Footprinting, Reconnaissance and Scanning questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Footprinting, Reconnaissance and Scanning explanation →

A security analyst runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?

Trap 1: Perform a full TCP connect scan with UDP service detection on all…

-sS is a SYN scan, not a full connect scan. -sV detects TCP service versions, not UDP. Not all ports are specified.

Trap 2: Perform an aggressive scan of all open ports and enumerate SMB…

The -A flag enables aggressive mode (not used here). SMB enumeration requires specific scripts (--script smb-enum-shares). The specified ports do not include 445.

Trap 3: Perform a UDP scan on the four specified ports and identify running…

-sS is a TCP SYN scan, not a UDP scan. UDP scanning requires the -sU flag.

Study all Footprinting, Reconnaissance and Scanning common traps →

A
Perform a full TCP connect scan with UDP service detection on all ports
Why wrong: -sS is a SYN scan, not a full connect scan. -sV detects TCP service versions, not UDP. Not all ports are specified.
B
Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting
-sS = SYN/stealth scan, -sV = version detection, -O = OS fingerprinting, -p 22,80,443,3389 = scan only these four ports. This is a targeted reconnaissance scan.
C
Perform an aggressive scan of all open ports and enumerate SMB shares
Why wrong: The -A flag enables aggressive mode (not used here). SMB enumeration requires specific scripts (--script smb-enum-shares). The specified ports do not include 445.
D
Perform a UDP scan on the four specified ports and identify running services
Why wrong: -sS is a TCP SYN scan, not a UDP scan. UDP scanning requires the -sU flag.

Footprinting, Reconnaissance and Scanning practice questions

What to know about Footprinting, Reconnaissance and Scanning

Common Footprinting, Reconnaissance and Scanning exam traps

Footprinting, Reconnaissance and Scanning questions

A security analyst runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?

During a passive reconnaissance phase, a penetration tester uses a tool to gather email addresses, subdomains, and employee names associated with a target domain without directly interacting with the target's systems. Which tool is BEST suited for this purpose?

A security analyst notices unusual outbound traffic from an internal server to a known malicious IP address on port 4444. The server is running a web application that was recently scanned using a vulnerability scanner. Which of the following is the MOST likely cause?

During a penetration test, you execute the following command: dnsrecon -d example.com -t axfr. The output shows 'AXFR record received' followed by a list of all DNS records. What does this indicate about the target's DNS configuration?

Which Google dork would a penetration tester use to find login pages of websites that have 'admin' in the URL?

A security team wants to identify all live hosts on a large, Class B private IP network (172.16.0.0/16) as quickly as possible while minimizing network load. Which tool and technique should they use?

A security analyst is conducting a vulnerability scan on a web server using Nessus. After the scan, they notice that the server's performance has degraded significantly, and some services have become unresponsive. Which of the following actions could have prevented this issue?

During a security assessment, a tester uses Maltego to gather information about a target organization. Which type of reconnaissance is being performed?

A penetration tester is attempting to evade an IDS/IPS while performing a port scan. They use the Nmap command: nmap -sS -f --data-length 20 -D RND:10 10.0.0.1. Which techniques are being employed to evade detection?

A security analyst receives an alert about a scan originating from an IP address that appears to be using a 'sIdle scan' technique. Which of the following characteristics would confirm this?

A junior penetration tester runs the command: whois example.com. What type of information are they MOST likely trying to obtain?

A security analyst is planning a reconnaissance activity that must remain undetected. Which TWO of the following techniques should they choose?

During a penetration test, you need to enumerate all DNS records for example.com using a zone transfer. Which TWO tools can be used to attempt this?

Which THREE of the following are valid Nmap port states?

A security analyst wants to perform passive reconnaissance on a target organization without generating any traffic to the target's network. Which of the following techniques would be MOST appropriate?

Which of the following tools is specifically designed to perform Google dorking and automate searching for vulnerable web applications and sensitive information?

During a penetration test, you need to identify all live hosts on a target network without being detected by intrusion detection systems. Which Nmap flag would BEST achieve this?

A penetration tester executes the following command: nmap -sS -p 1-1000 --script banner 192.168.1.10. After the scan, the tester notices several filtered ports. Which of the following BEST explains why Nmap reports a port as "filtered"?

A security analyst is performing reconnaissance on a target domain and wants to discover all subdomains using DNS enumeration. Which of the following commands would be MOST effective for performing a DNS zone transfer attempt?

Track your progress over time

Start a Footprinting, Reconnaissance and Scanning only practice session

Related CEH topic practice pages

Footprinting, Reconnaissance and Scanning practice questions

Enumeration and System Hacking practice questions

Malware, Social Engineering and Network Attacks practice questions

Web Application and Injection Attacks practice questions

Introduction to Ethical Hacking practice questions

Scanning Networks and Enumeration practice questions

Vulnerability Analysis and System Hacking practice questions

Advanced Topics: Wireless, Cloud, IoT, Cryptography practice questions

Footprinting and Reconnaissance practice questions

Network and Web Application Attacks practice questions

Wireless, IoT and Cloud Security practice questions

Cryptography and Malware Analysis practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid