CEH Footprinting, Reconnaissance and Scanning Practice Question
Which of the following tools is specifically designed to perform fast internet-wide scanning, often used in the reconnaissance phase to discover open ports across large IP ranges?
⚠ Common exam trap
A common mix-up: candidates choose Nmap because it is the most famous scanning tool, but the question specifically asks for a tool designed for 'fast internet-wide scanning,' which is Masscan's unique selling point over Nmap's slower, more thorough approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Masscan
Masscan is specifically designed for high-speed, asynchronous scanning of large IP ranges, capable of transmitting packets at rates exceeding 10 million packets per second. This makes it the optimal tool for internet-wide reconnaissance to discover open ports across vast address spaces, a task for which Nmap is too slow and hping3 is too manual.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
hping3
Why it's wrong here
hping3 crafts and sends custom TCP/IP packets for firewall testing and host-level probing; it lacks the asynchronous stateless scan engine needed to sweep large IP ranges quickly. It is tempting because it performs port probing, and would be correct for packet-crafting tests against individual targets.
- ✗
OpenVAS
Why it's wrong here
OpenVAS is a vulnerability scanner: it authenticates to targets and enumerates known CVEs, so it cannot sweep the whole internet for open ports. It is tempting because it does perform port discovery, but only as a precursor to vulnerability checks against defined scopes, not mass internet-wide scanning.
- ✓
Masscan
Why this is correct
Masscan uses its own asynchronous TCP/IP stack, enabling it to scan the entire internet's address space in minutes by transmitting packets at rates far beyond conventional scanners. This satisfies the reconnaissance requirement for fast, internet-wide open-port discovery across large IP ranges.
- ✗
Nmap
Why it's wrong here
Nmap is a host-discovery and port-scanning utility optimised for accuracy and service detection against defined targets, not for saturating internet-wide address space at scale. It is tempting because it enumerates open ports, and would be correct for detailed scanning of a specified subnet or host list.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 913 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which of the following tools is specifically designed for high-speed port scanning across large address spaces?
easy- ✓ A.Masscan
- B.Zenmap
- C.hping3
- D.Nmap
Why A: Masscan is specifically designed for high-speed port scanning across large address spaces, capable of transmitting packets at rates exceeding 10 million packets per second. It achieves this by using asynchronous transmission and a custom TCP/IP stack, making it ideal for scanning the entire IPv4 internet or massive subnets in minutes, unlike general-purpose scanners that prioritize accuracy over raw speed.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.