A security operations center (SOC) is evaluating tools to detect enumeration attempts against a large enterprise network. The SOC wants to identify both port scans and service probes, but also wants to minimize false positives that could overwhelm analysts. Which approach is most effective?

Deploy a standalone IDS that alerts on every port scan signature, regardless of source or frequency.

Enable verbose logging on all servers and review logs manually on a weekly basis.

Deploy a SIEM that aggregates logs from firewalls, IDS, and servers, and use correlation rules to detect patterns of scanning and probing.

Use a vulnerability scanner to perform continuous scans and compare results to a baseline.

A penetration test revealed that an attacker was able to enumerate user accounts and shares on a Windows server via SMB null sessions. The administrator must harden the server without breaking legitimate file sharing for authenticated users. Which set of actions should be taken?

Disable SMB entirely and use FTP for file sharing, allowing anonymous read-only access to the shared folders.

Enable SMB signing and leave null sessions enabled but restrict them to the local subnet.

Keep SMBv1 enabled for legacy clients and set the 'RestrictNullSessAccess' registry key to 0 to allow anonymous access.

Disable SMBv1, enforce SMB signing, and disable null session access by requiring authentication for all SMB connections.

What is the primary purpose of configuring firewall rules to limit the number of allowed ports and protocols?

To increase network speed by eliminating unnecessary traffic

To reduce the attack surface and make port scanning less effective by only exposing necessary services

To ensure that all traffic is encrypted in transit

To prevent any external host from communicating with the network

What is the primary purpose of split-horizon DNS?

To encrypt all DNS queries between clients and servers

To provide different DNS responses to internal and external users, hiding internal hostnames from external queries

To increase DNS resolution speed by caching responses locally

To allow zone transfers to any external server for redundancy

What is the role of a SIEM system in preventing and detecting enumeration?

To aggregate and correlate logs from multiple sources to identify patterns indicative of enumeration attempts

To block all malicious traffic at the network perimeter

To automatically patch vulnerabilities in software

To encrypt all log data at rest

EC-CouncilCertified Ethical Hacker

Domain 2Objective 7

Enumeration Countermeasures CEH Practice Questions (Page 8)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 65 practice questions to prepare you well beyond it. (estimate)

65questions here

13free pages

16concepts

16 Concepts in This Objective

Enumeration Countermeasures Overview
Network Enumeration Countermeasures
Port Scanning Countermeasures
Service Enumeration Countermeasures
SNMP Enumeration Countermeasures
DNS Enumeration Countermeasures
Active Directory Enumeration Countermeasures
SMB Enumeration Countermeasures
LDAP Enumeration Countermeasures
Email Enumeration Countermeasures
User Enumeration Countermeasures
Web Enumeration Countermeasures
Wireless Enumeration Countermeasures
Cloud Enumeration Countermeasures
IoT Enumeration Countermeasures
Enumeration Countermeasure Tools and Techniques

Questions 36–40

36expert · hard
A security operations center (SOC) is evaluating tools to detect enumeration attempts against a large enterprise network. The SOC wants to identify both port scans and service probes, but also wants to minimize false positives that could overwhelm analysts. Which approach is most effective?
Select an answer first
37application · medium
A penetration test revealed that an attacker was able to enumerate user accounts and shares on a Windows server via SMB null sessions. The administrator must harden the server without breaking legitimate file sharing for authenticated users. Which set of actions should be taken?
Select an answer first
38foundation · easy
What is the primary purpose of configuring firewall rules to limit the number of allowed ports and protocols?
Select an answer first
39foundation · easy
What is the primary purpose of split-horizon DNS?
Select an answer first
40foundation · easy
What is the role of a SIEM system in preventing and detecting enumeration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.