During a penetration test, you need to map the network perimeter of a client. You have been given a list of IP ranges. Which sequence of scanning activities best aligns with the reconnaissance phase's goal of building a network profile?

Perform OS fingerprinting on all IPs, then host discovery

Perform vulnerability scan first, then host discovery, then port scan

Perform host discovery, then port scan the live hosts, then identify services and versions

Port scan all IPs, then perform host discovery on open ports

EC-CouncilCertified Ethical Hacker

Domain 2Objective 3

Network Scanning and Host Discovery CEH Practice Questions (Page 2)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 6–10

6foundation · easy
Which protocol is commonly used for host discovery on a local network by sending an ARP request to determine if a host is active?
Select an answer first
7foundation · easy
Which Nmap option is used to perform service and version detection on open ports?
Select an answer first
8foundation · easy
During the reconnaissance phase, a penetration tester sends packets to a target network to identify live hosts, open ports, and running services. What is this activity called?
Select an answer first
9foundation · easy
Which port scanning technique completes the full TCP three-way handshake to determine if a port is open?
Select an answer first
10application · easy
During a penetration test, you need to map the network perimeter of a client. You have been given a list of IP ranges. Which sequence of scanning activities best aligns with the reconnaissance phase's goal of building a network profile?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Network Scanning and Host Discovery CEH Practice Questions (Page 2)

Questions 6–10

Which protocol is commonly used for host discovery on a local network by sending an ARP request to determine if a host is active?

Which Nmap option is used to perform service and version detection on open ports?

During the reconnaissance phase, a penetration tester sends packets to a target network to identify live hosts, open ports, and running services. What is this activity called?

Which port scanning technique completes the full TCP three-way handshake to determine if a port is open?

During a penetration test, you need to map the network perimeter of a client. You have been given a list of IP ranges. Which sequence of scanning activities best aligns with the reconnaissance phase's goal of building a network profile?

Keep studying — Reconnaissance Techniques