CEH Scanning Networks and Enumeration Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Perform a TCP connect scan (-sT) on all ports of the subnet to identify open ports and services.

  Why it's wrong here

  A TCP connect scan (-sT) is highly detectable because it completes the full TCP three-way handshake (SYN, SYN/ACK, ACK) for every open port. This full connection establishment is logged by most intrusion detection systems (IDS) and firewalls, making it a noisy and easily traceable method. Furthermore, scanning all 65535 ports across an entire subnet with this method would generate an immense volume of network traffic, significantly increasing the likelihood of detection and potentially impacting network performance.

• ✗

  Perform an Xmas scan (-sX) on all ports of the subnet to evade detection by sending packets with invalid flag combinations.

  Why it's wrong here

  An Xmas scan (-sX) attempts to evade detection by sending TCP packets with the FIN, PSH, and URG flags set, expecting no response for open ports and an RST for closed ports, based on RFC 793. However, many modern firewalls and operating systems do not strictly adhere to this RFC behavior, often dropping such malformed packets or responding inconsistently. This makes the Xmas scan unreliable for accurately determining port states, especially against hardened targets or those behind stateful firewalls, leading to false negatives or positives.

• ✓

  First, perform a TCP SYN scan (-sS) on the three allowed ports across the subnet. Once a live host is identified, perform a TCP SYN scan (-sS) on all 65535 ports of that host.

  Why this is correct

  The TCP SYN scan (-sS), also known as a "half-open" scan, is highly effective and stealthy because it initiates a TCP handshake but does not complete it. It sends a SYN packet and, upon receiving a SYN/ACK, immediately sends an RST, preventing full connection logging. This two-phase approach is optimal: initially scanning only the three known allowed ports across the subnet efficiently identifies active hosts, then a comprehensive SYN scan on all 65535 ports of *only* the live hosts provides a detailed service map while minimizing overall network footprint and detection risk.

• ✗

  Perform a UDP scan (-sU) on all ports of the subnet because UDP is connectionless and less likely to be logged.

  Why it's wrong here

  A UDP scan (-sU) is inherently slow and unreliable for identifying open UDP ports because it relies on receiving an ICMP Port Unreachable message for closed ports, which can be rate-limited or dropped by firewalls. For open UDP ports, there's often no response unless an application-layer service responds, making it difficult to distinguish between open and filtered states. Crucially, a UDP scan is completely ineffective for discovering TCP-based services, which are the primary focus for most network penetration tests, rendering it an inappropriate choice for this objective.

Go deeper

Related to this question