How should I use these Scanning Networks and Enumeration practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Scanning Networks and Enumeration questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Scanning Networks and Enumeration domain.

CEH · topic practice

Scanning Networks and Enumeration practice questions

Practise Certified Ethical Hacker CEH Scanning Networks and Enumeration practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

19 questionsDomain: Scanning Networks and Enumeration

Practice 10 questions Browse domain →

What the exam tests

What to know about Scanning Networks and Enumeration

Scanning Networks and Enumeration questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Scanning Networks and Enumeration exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Scanning Networks and Enumeration questions

19 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Scanning Networks and Enumeration explanation →

During a penetration test, you discover that an internal web server responds to ICMP echo requests but does not respond to TCP SYN scans on port 80. However, when you browse to the server's IP using a browser, the web page loads successfully. What is the most likely reason for this behavior?

Trap 1: The web server is running on a non-standard port that you did not…

The scan targeted port 80 and got no response, but browsing works; so the server is reachable on port 80 via a different mechanism.

Trap 2: The server's TCP/IP stack is misconfigured and does not respond to…

Misconfiguration would likely affect all TCP connections, not just scans.

Trap 3: A web application firewall is blocking the SYN scan traffic.

WAFs operate at layer 7, not blocking TCP handshake packets.

Study all Scanning Networks and Enumeration common traps →

A
A stateful firewall is blocking inbound SYN packets to port 80 but allowing responses to outbound connections.
Stateful firewalls track connection states; they may block unsolicited SYN but allow replies.
B
The web server is running on a non-standard port that you did not scan.
Why wrong: The scan targeted port 80 and got no response, but browsing works; so the server is reachable on port 80 via a different mechanism.
C
The server's TCP/IP stack is misconfigured and does not respond to SYN scans.
Why wrong: Misconfiguration would likely affect all TCP connections, not just scans.
D
A web application firewall is blocking the SYN scan traffic.
Why wrong: WAFs operate at layer 7, not blocking TCP handshake packets.

Full breakdown with real-world context →

Question 2easymultiple choice

Read the full Scanning Networks and Enumeration explanation →

A security analyst is using Nmap to scan a network segment 192.168.1.0/24 and wants to identify live hosts without sending packets to every IP. Which scan type should the analyst use to minimize network traffic while discovering active hosts?

Trap 1: TCP SYN scan using `nmap -sS`

SYN scan probes ports, not just host discovery; generates more traffic.

Trap 2: ARP scan using `nmap -PR`

ARP scan is fast but sends ARP requests to every IP, which is still per-IP traffic.

Trap 3: UDP scan using `nmap -sU`

UDP scan is slow and often unreliable for host discovery.

Study all Scanning Networks and Enumeration common traps →

A
TCP SYN scan using `nmap -sS`
Why wrong: SYN scan probes ports, not just host discovery; generates more traffic.
B
ARP scan using `nmap -PR`
Why wrong: ARP scan is fast but sends ARP requests to every IP, which is still per-IP traffic.
C
Ping sweep using `nmap -sn`
`-sn` disables port scan and sends only ICMP echo, TCP SYN to port 443, etc., minimizing traffic.
D
UDP scan using `nmap -sU`
Why wrong: UDP scan is slow and often unreliable for host discovery.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full Scanning Networks and Enumeration explanation →

During an internal penetration test, you are tasked with enumerating services on a target server. You run a full TCP port scan and find that ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) are open. You then perform version detection on these ports. Which additional enumeration step would provide the most valuable information for identifying potential vulnerabilities?

Trap 1: Perform SNMP enumeration to gather system information.

SNMP service is not indicated as open; requires UDP port 161.

Trap 2: Attempt a DNS zone transfer from the server.

DNS zone transfer is for DNS servers; the target is a web server.

Trap 3: Enumerate NetBIOS names using `nbtstat`.

NetBIOS is typically Windows-only and requires specific ports not open.

Study all Scanning Networks and Enumeration common traps →

A
Perform banner grabbing on port 22 to identify the SSH version.
SSH version information can reveal outdated versions with known exploits.
B
Perform SNMP enumeration to gather system information.
Why wrong: SNMP service is not indicated as open; requires UDP port 161.
C
Attempt a DNS zone transfer from the server.
Why wrong: DNS zone transfer is for DNS servers; the target is a web server.
D
Enumerate NetBIOS names using `nbtstat`.
Why wrong: NetBIOS is typically Windows-only and requires specific ports not open.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Scanning Networks and Enumeration explanation →

A network administrator needs to identify all devices on a large corporate network that are running a specific vulnerable version of OpenSSH. The administrator has network access and can use scanning tools. However, scanning the entire network might disrupt operations. Which approach minimizes disruption while accurately identifying the vulnerable hosts?

Trap 1: Conduct a full TCP port scan of the entire network using SYN scan.

Full port scans are noisy and may cause performance issues on network devices.

Trap 2: Use a ping sweep to identify live hosts, then perform a version…

Ping sweep is less disruptive but still requires probing each live host; version scan still needed.

Trap 3: Perform an ARP scan of the entire subnet and then check each host…

Manual checking is inefficient and still requires direct interaction with each host.

Study all Scanning Networks and Enumeration common traps →

A
Conduct a full TCP port scan of the entire network using SYN scan.
Why wrong: Full port scans are noisy and may cause performance issues on network devices.
B
Run a TCP SYN scan on port 22 only, with version detection enabled, across the target IP range.
Scanning only the relevant port with version detection minimizes traffic and focuses on the vulnerable service.
C
Use a ping sweep to identify live hosts, then perform a version scan on each.
Why wrong: Ping sweep is less disruptive but still requires probing each live host; version scan still needed.
D
Perform an ARP scan of the entire subnet and then check each host manually.
Why wrong: Manual checking is inefficient and still requires direct interaction with each host.

Full breakdown with real-world context →

Question 5easymultiple choice

Read the full NAT/PAT explanation →

You are conducting a security assessment and need to map the network topology and identify routers, firewalls, and other network devices. Which technique is specifically designed to discover the path packets take to reach a destination and can reveal intermediate devices?

Trap 1: Banner grabbing

Banner grabbing identifies services, not network topology.

Trap 2: DNS enumeration

DNS enumeration reveals hostnames and IPs but not the network path.

Trap 3: SNMP walk

SNMP walk retrieves MIB data, not routing paths.

Study all Scanning Networks and Enumeration common traps →

A
Traceroute
Traceroute increments TTL to get ICMP time-exceeded messages from routers, revealing the path.
B
Banner grabbing
Why wrong: Banner grabbing identifies services, not network topology.
C
DNS enumeration
Why wrong: DNS enumeration reveals hostnames and IPs but not the network path.
D
SNMP walk
Why wrong: SNMP walk retrieves MIB data, not routing paths.

Full breakdown with real-world context →

Question 6hardmulti select

Read the full network assurance explanation →

Which TWO types of information can be obtained through SNMP enumeration on a target device if the community string is 'public'? (Choose two.)

Trap 1: Captured network packets

Packet capture is not an SNMP function.

Trap 2: User account passwords

Passwords are not stored in SNMP MIBs.

Trap 3: Modify network interface settings

Modification requires write access, typically with a different community string.

Study all Scanning Networks and Enumeration common traps →

A
List of running processes
SNMP can retrieve hrSWRunTable which lists running processes.
B
Captured network packets
Why wrong: Packet capture is not an SNMP function.
C
User account passwords
Why wrong: Passwords are not stored in SNMP MIBs.
D
Modify network interface settings
Why wrong: Modification requires write access, typically with a different community string.
E
Routing table entries
SNMP can read the ipRouteTable MIB object.

Full breakdown with real-world context →

Question 7mediummulti select

Read the full Scanning Networks and Enumeration explanation →

Which THREE Nmap options are commonly used to evade firewall detection during a scan? (Choose three.)

Trap 1: -sT (TCP connect scan)

TCP connect scan completes the handshake and is more likely logged.

Trap 2: -sV (version detection)

Version detection sends additional probes, increasing detectability.

Study all Scanning Networks and Enumeration common traps →

A
-f (fragment packets)
Fragmentation splits packet headers to evade simple packet filters.
B
-T0 (paranoid timing)
Slow timing evades rate-based detection.
C
-D (decoy)
Decoy option spoofs multiple source IPs to confuse firewalls.
D
-sT (TCP connect scan)
Why wrong: TCP connect scan completes the handshake and is more likely logged.
E
-sV (version detection)
Why wrong: Version detection sends additional probes, increasing detectability.

Full breakdown with real-world context →

Question 8mediummultiple choice

Read the full Scanning Networks and Enumeration explanation →

Refer to the exhibit. An Nmap scan shows that port 80 is 'filtered' while ports 22 and 443 are 'open'. What does the 'filtered' state indicate?

Exhibit

Refer to the exhibit.
```
Starting Nmap 7.92 ( https://nmap.org ) at 2025-03-25 14:22 EDT
Nmap scan report for 10.10.1.45
Host is up (0.045s latency).
Not shown: 997 closed tcp ports (reset)
PORT     STATE    SERVICE
22/tcp   open     ssh
80/tcp   filtered http
443/tcp  open     https
```

Trap 1: The port is closed and the target sent a RST packet.

Closed ports send RST, which Nmap reports as 'closed'.

Trap 2: The port is open but the service is not responding to the scan.

If open, Nmap would detect a SYN/ACK response.

Trap 3: The port is open but Nmap cannot determine the service.

Nmap distinguishes filtered from unfiltered; unfiltered means open/closed but no version.

Study all Scanning Networks and Enumeration common traps →

A
The port is closed and the target sent a RST packet.
Why wrong: Closed ports send RST, which Nmap reports as 'closed'.
B
The port is open but the service is not responding to the scan.
Why wrong: If open, Nmap would detect a SYN/ACK response.
C
The port is open but Nmap cannot determine the service.
Why wrong: Nmap distinguishes filtered from unfiltered; unfiltered means open/closed but no version.
D
A firewall, router rule, or host-based firewall is blocking the probes.
Filtered indicates that probes are being dropped or blocked.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full NAT/PAT explanation →

You are a penetration tester assessing a client's internal network. The client has provided you with a non-administrative domain user account. The target network consists of 200 Windows workstations and 5 Windows servers (one domain controller, one file server, two application servers, and one database server). All systems are fully patched and have host-based firewalls enabled. The client wants you to identify vulnerabilities that could be exploited from the internal network. After initial reconnaissance, you discover that all servers have SMB (port 445) open only to the domain controller and the file server has SMB open to all workstations. You have gained a foothold on a workstation via a phishing attack. From this workstation, you can reach the file server on port 445. What is the most effective next step to enumerate potential vulnerabilities on the file server?

Trap 1: Attempt to connect to the file server via RDP (port 3389) using the…

RDP may not be open on the file server, and you only have limited credentials.

Trap 2: Use PsExec to execute commands remotely on the file server using…

PsExec requires administrative privileges on the target, which you likely don't have.

Trap 3: Run a full vulnerability scan (e.g., Nessus) against the entire…

Full scans are noisy and may trigger alerts; targeted enumeration is more appropriate.

Study all Scanning Networks and Enumeration common traps →

A
Attempt to connect to the file server via RDP (port 3389) using the compromised user's credentials.
Why wrong: RDP may not be open on the file server, and you only have limited credentials.
B
Use PsExec to execute commands remotely on the file server using the compromised user account.
Why wrong: PsExec requires administrative privileges on the target, which you likely don't have.
C
Run a full vulnerability scan (e.g., Nessus) against the entire subnet to identify weaknesses.
Why wrong: Full scans are noisy and may trigger alerts; targeted enumeration is more appropriate.
D
Enumerate SMB shares and session information using `net view \\fileserver` and `smbclient -L //fileserver`.
This reveals accessible shares and potential misconfigurations like null sessions.

Full breakdown with real-world context →

Question 10mediummultiple choice

Read the full Scanning Networks and Enumeration explanation →

A penetration tester discovers that an Nmap SYN scan against a target host returns no open ports, but a TCP connect scan reveals port 443 open. Which of the following is the most likely reason for this discrepancy?

Trap 1: The target host has a host-based firewall that drops SYN packets…

Host-based firewalls typically treat SYN packets the same as any other TCP packet; they don't distinguish half-open vs. full connection.

Trap 2: The target host has ICMP filtering enabled, preventing Nmap from…

ICMP filtering would affect ping sweeps, not TCP scans; Nmap uses TCP probes to determine host status regardless of ICMP.

Trap 3: Nmap's SYN scan requires root privileges, and the tester ran it…

If the tester ran SYN scan without root, Nmap would fall back to connect scan automatically, not return no open ports.

Study all Scanning Networks and Enumeration common traps →

A
The target host has a host-based firewall that drops SYN packets but allows full connections.
Why wrong: Host-based firewalls typically treat SYN packets the same as any other TCP packet; they don't distinguish half-open vs. full connection.
B
A network firewall is performing stateful inspection and dropping unsolicited SYN packets while allowing established connections.
Stateful firewalls track connections; a SYN scan sends unsolicited SYN packets that may be dropped, while a connect scan completes the handshake and appears as a normal connection.
C
The target host has ICMP filtering enabled, preventing Nmap from identifying it as online.
Why wrong: ICMP filtering would affect ping sweeps, not TCP scans; Nmap uses TCP probes to determine host status regardless of ICMP.
D
Nmap's SYN scan requires root privileges, and the tester ran it without sudo.
Why wrong: If the tester ran SYN scan without root, Nmap would fall back to connect scan automatically, not return no open ports.

Full breakdown with real-world context →

Question 11hardmulti select

Read the full Scanning Networks and Enumeration explanation →

Which THREE of the following are valid methods for enumerating users on a Windows domain without prior credentials? (Select exactly 3.)

Trap 1: Requesting a DNS zone transfer to obtain a list of user account…

DNS zone transfers provide hostnames and IPs, not user account names.

Trap 2: Sending Kerberos AS-REQ packets and analyzing the error codes…

This technique requires knowing a valid username to get a different error; it cannot enumerate unknown users.

Study all Scanning Networks and Enumeration common traps →

A
Requesting a DNS zone transfer to obtain a list of user account names from the SRV records.
Why wrong: DNS zone transfers provide hostnames and IPs, not user account names.
B
Performing an SMB null session and querying the SAM database.
SMB null sessions are a known method for enumerating users on older Windows systems.
C
Using RID cycling to enumerate users by brute-forcing relative identifiers.
RID cycling allows enumeration of user accounts by iterating through RIDs.
D
Performing an anonymous LDAP query to the domain controller for objectClass=user.
LDAP anonymous queries can enumerate user objects if the DC does not restrict them.
E
Sending Kerberos AS-REQ packets and analyzing the error codes (e.g., KDC_ERR_PREAUTH_REQUIRED vs KDC_ERR_C_PRINCIPAL_UNKNOWN).
Why wrong: This technique requires knowing a valid username to get a different error; it cannot enumerate unknown users.

Full breakdown with real-world context →

Question 12easymultiple choice

Read the full Scanning Networks and Enumeration explanation →

Refer to the exhibit. A penetration tester runs the above Nmap scan. Which of the following statements is most accurate regarding the state of port 3389?

Exhibit

Refer to the exhibit.

```
$ sudo nmap -sS -sV -O -p 1-1000 192.168.1.10
Starting Nmap 7.93 ( https://nmap.org )
Nmap scan report for 192.168.1.10
Host is up (0.0012s latency).
Not shown: 995 closed ports
PORT     STATE    SERVICE         VERSION
22/tcp   open     ssh             OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
80/tcp   open     http            Apache httpd 2.4.52
443/tcp  open     ssl/http        Apache httpd 2.4.52
3389/tcp filtered ms-wbt-server
8080/tcp open     http-proxy      Apache httpd 2.4.52
Device type: general purpose
Running: Linux 5.X
OS CPE: cpe:/o:linux:linux_kernel:5
OS details: Linux 5.0 - 5.14
Network Distance: 1 hop
```

Trap 1: Port 3389 is open and running a Remote Desktop service, but the…

A filtered port does not indicate the service is open; it only shows that Nmap cannot probe it.

Trap 2: Port 3389 is closed and the target is ignoring the probe.

A closed port would show as 'closed' in Nmap output, not 'filtered'.

Trap 3: The target is likely a honeypot designed to simulate a Windows…

There is no indication of a honeypot; the filtered state is typical of a firewall.

Study all Scanning Networks and Enumeration common traps →

A
Port 3389 is open and running a Remote Desktop service, but the service version could not be identified.
Why wrong: A filtered port does not indicate the service is open; it only shows that Nmap cannot probe it.
B
Port 3389 is closed and the target is ignoring the probe.
Why wrong: A closed port would show as 'closed' in Nmap output, not 'filtered'.
C
The target is likely a honeypot designed to simulate a Windows machine.
Why wrong: There is no indication of a honeypot; the filtered state is typical of a firewall.
D
A firewall is likely blocking the scan probes to port 3389, preventing Nmap from determining whether the port is open.
The 'filtered' state means Nmap could not determine if the port is open or closed, usually due to packet filtering.

Full breakdown with real-world context →

Question 13hardmultiple choice

Review the full subnetting walkthrough →

You are conducting a security assessment for a company that hosts a web application on AWS. The application consists of a public-facing load balancer, an EC2 instance running a Linux web server, and an RDS MySQL database in a private subnet. The web server is configured to allow SSH access only from the company's internal IP range (203.0.113.0/24). During initial reconnaissance, you discover that the load balancer's security group allows inbound HTTP/HTTPS from anywhere. You attempt an Nmap SYN scan against the EC2 instance's public IP but receive no response (host appears down). Using a TCP connect scan, you find that ports 80 and 443 are open on the EC2 instance's public IP, but port 22 is filtered. You then launch an EC2 instance in the same region and run a scan from that internal AWS IP, and you find that port 22 is open on the target EC2 instance's private IP. Which of the following is the most likely reason for the initial scan failure and the filtered SSH port?

Question 14easymulti select

Read the full Scanning Networks and Enumeration explanation →

Which TWO of the following Nmap scan types are typically used to evade firewalls and IDS systems by sending fragmented packets?

Trap 1: SYN scan (-sS)

SYN scan is not specifically evasive; it is the default scan.

Trap 2: ACK scan (-sA)

ACK scan is used for firewall rule mapping, not evasion.

Trap 3: Xmas scan (-sX)

Xmas scan is detectable and not evasive.

Study all Scanning Networks and Enumeration common traps →

A
Fragment scan (-f)
Correct: Fragments packets to bypass firewalls.
B
SYN scan (-sS)
Why wrong: SYN scan is not specifically evasive; it is the default scan.
C
ACK scan (-sA)
Why wrong: ACK scan is used for firewall rule mapping, not evasion.
D
Idle scan (-sI)
Correct: Uses a zombie host to spoof IP, evading detection.
E
Xmas scan (-sX)
Why wrong: Xmas scan is detectable and not evasive.

Full breakdown with real-world context →

Question 15hardmultiple choice

Read the full Scanning Networks and Enumeration explanation →

You are a penetration tester for a financial institution. During the reconnaissance phase, you discover that the target network uses a firewall that only allows inbound TCP connections on ports 80, 443, and 8080. You need to identify live hosts and running services on the internal network (192.168.1.0/24) from an external perspective. To avoid detection, you must minimize the number of packets sent and ensure that your scanning technique does not complete the TCP three-way handshake. Additionally, you have limited time and need to scan all 65535 ports on the most promising target. Based on the firewall rules and the need for stealth, which of the following approaches should you take?

Trap 1: Perform a TCP connect scan (-sT) on all ports of the subnet to…

Connect scan completes the three-way handshake, is not stealthy, and generates more traffic.

Trap 2: Perform an Xmas scan (-sX) on all ports of the subnet to evade…

Xmas scan can be filtered by firewalls and is less reliable for determining open ports.

Trap 3: Perform a UDP scan (-sU) on all ports of the subnet because UDP is…

UDP scan is slow, unreliable, and may be blocked by firewall; also not stealthy for TCP services.

Study all Scanning Networks and Enumeration common traps →

A
Perform a TCP connect scan (-sT) on all ports of the subnet to identify open ports and services.
Why wrong: Connect scan completes the three-way handshake, is not stealthy, and generates more traffic.
B
Perform an Xmas scan (-sX) on all ports of the subnet to evade detection by sending packets with invalid flag combinations.
Why wrong: Xmas scan can be filtered by firewalls and is less reliable for determining open ports.
C
First, perform a TCP SYN scan (-sS) on the three allowed ports across the subnet. Once a live host is identified, perform a TCP SYN scan (-sS) on all 65535 ports of that host.
TCP SYN scan is stealthy (half-open) and efficient. Scanning only allowed ports first reduces traffic, then full port scan on the live host.
D
Perform a UDP scan (-sU) on all ports of the subnet because UDP is connectionless and less likely to be logged.
Why wrong: UDP scan is slow, unreliable, and may be blocked by firewall; also not stealthy for TCP services.

Full breakdown with real-world context →

Question 16mediumdrag order

Read the full Scanning Networks and Enumeration explanation →

Drag and drop the steps to conduct a penetration test using the CEH methodology into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 17mediumdrag order

Read the full Scanning Networks and Enumeration explanation →

Drag and drop the steps to perform a buffer overflow exploit in a controlled lab environment into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 18mediummatching

Read the full Scanning Networks and Enumeration explanation →

Match each security tool to its primary purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Network scanning and enumeration

Packet capture and analysis

Exploitation framework

Password cracking

Web application security testing

Question 19mediummatching

Read the full Scanning Networks and Enumeration explanation →

Match each cloud security concept to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Infrastructure as a Service - virtualized computing resources

Platform as a Service - development and deployment platform

Software as a Service - ready-to-use applications

Security duties split between provider and customer

Cloud Access Security Broker - policy enforcement between users and cloud

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Scanning Networks and Enumeration sessions

Start a Scanning Networks and Enumeration only practice session

Every question in these sessions is drawn from the Scanning Networks and Enumeration domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Scanning Networks and Enumeration questions →Mixed CEH session

Frequently asked questions

What does the CEH exam test about Scanning Networks and Enumeration?: Scanning Networks and Enumeration questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Scanning Networks and Enumeration questions in a focused session?: Yes — the session launcher on this page draws every question from the Scanning Networks and Enumeration domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CEH topics?: Use the topic links above to move to related areas, or go back to the CEH question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the CEH exam covers. They are not copied from any real exam or dump site.

Scanning Networks and Enumeration only

10 questions 20 questions 30 questions 50 questions

Mixed CEH session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All CEH questions Scanning Networks and Enumeration domain overview CEH exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Scanning Networks and Enumeration practice questions

What to know about Scanning Networks and Enumeration

Common Scanning Networks and Enumeration exam traps

Scanning Networks and Enumeration questions

During a penetration test, you discover that an internal web server responds to ICMP echo requests but does not respond to TCP SYN scans on port 80. However, when you browse to the server's IP using a browser, the web page loads successfully. What is the most likely reason for this behavior?

A security analyst is using Nmap to scan a network segment 192.168.1.0/24 and wants to identify live hosts without sending packets to every IP. Which scan type should the analyst use to minimize network traffic while discovering active hosts?

You are conducting a security assessment and need to map the network topology and identify routers, firewalls, and other network devices. Which technique is specifically designed to discover the path packets take to reach a destination and can reveal intermediate devices?

Which TWO types of information can be obtained through SNMP enumeration on a target device if the community string is 'public'? (Choose two.)

Which THREE Nmap options are commonly used to evade firewall detection during a scan? (Choose three.)

Refer to the exhibit. An Nmap scan shows that port 80 is 'filtered' while ports 22 and 443 are 'open'. What does the 'filtered' state indicate?

Exhibit

A penetration tester discovers that an Nmap SYN scan against a target host returns no open ports, but a TCP connect scan reveals port 443 open. Which of the following is the most likely reason for this discrepancy?

Which THREE of the following are valid methods for enumerating users on a Windows domain without prior credentials? (Select exactly 3.)

Refer to the exhibit. A penetration tester runs the above Nmap scan. Which of the following statements is most accurate regarding the state of port 3389?

Exhibit

Which TWO of the following Nmap scan types are typically used to evade firewalls and IDS systems by sending fragmented packets?

Drag and drop the steps to conduct a penetration test using the CEH methodology into the correct order.

Drag and drop the steps to perform a buffer overflow exploit in a controlled lab environment into the correct order.

Match each security tool to its primary purpose.

Match each cloud security concept to its description.

Track your progress over time

Start a Scanning Networks and Enumeration only practice session

Related CEH topic practice pages

Footprinting, Reconnaissance and Scanning practice questions

Enumeration and System Hacking practice questions

Malware, Social Engineering and Network Attacks practice questions

Web Application and Injection Attacks practice questions

Introduction to Ethical Hacking practice questions