A penetration tester is conducting an external scan of a target network. The tester wants to avoid detection by an IDS that triggers on high volumes of packets from a single source. Which technique is most effective for reducing the packet rate while still scanning all desired ports?

Use Nmap's -sU option to scan UDP ports

Use Nmap's -p- option to scan all ports

Use Nmap's timing template -T1 to slow down the scan

Use Nmap's -O option to enable OS detection

A network administrator wants to reduce the effectiveness of external network scans against the company's public-facing servers. The administrator cannot change the IP addresses of the servers and must maintain legitimate remote access for administrators. Which countermeasure is most effective?

Disable all ICMP responses on the firewall

Configure the IDS to alert on any port scan

Implement port knocking to hide open ports until a specific sequence is sent

Use a stateful firewall that drops all inbound SYN packets

A junior penetration tester is about to scan a client's network. The client has provided a written authorization that includes the IP ranges to scan and the time window. Which additional step is most important before starting the scan?

Verify the scope and rules of engagement with the client

Inform the client's ISP about the scan

Ensure the scan is configured to avoid crashing the target

Select the fastest scan timing to complete within the window

A penetration tester is conducting an authorized assessment of a client's network. The client's firewall drops all unsolicited inbound TCP packets but allows outbound TCP traffic. The tester needs to identify which internal hosts are alive and which common ports are open, while minimizing the chance of the scan being logged by the firewall. Which Nmap scan type should the tester choose?

TCP SYN scan (-sS) against a list of common ports

TCP connect scan (-sT) against all 65535 ports

ICMP ping sweep (-sn) to find live hosts, then a TCP connect scan

UDP scan (-sU) against common ports

EC-CouncilCertified Ethical Hacker

Domain 2Objective 3

Network Scanning and Host Discovery CEH Practice Questions (Page 3)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 11–15

11application · medium
A penetration tester is conducting an external scan of a target network. The tester wants to avoid detection by an IDS that triggers on high volumes of packets from a single source. Which technique is most effective for reducing the packet rate while still scanning all desired ports?
Select an answer first
12application · medium
A network administrator wants to reduce the effectiveness of external network scans against the company's public-facing servers. The administrator cannot change the IP addresses of the servers and must maintain legitimate remote access for administrators. Which countermeasure is most effective?
Select an answer first
13application · easy
A junior penetration tester is about to scan a client's network. The client has provided a written authorization that includes the IP ranges to scan and the time window. Which additional step is most important before starting the scan?
Select an answer first
14application · medium
A penetration tester is conducting an authorized assessment of a client's network. The client's firewall drops all unsolicited inbound TCP packets but allows outbound TCP traffic. The tester needs to identify which internal hosts are alive and which common ports are open, while minimizing the chance of the scan being logged by the firewall. Which Nmap scan type should the tester choose?
Select an answer first
15foundation · easy
Which technique hides services by requiring a specific sequence of connection attempts to open a port?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Network Scanning and Host Discovery CEH Practice Questions (Page 3)

Questions 11–15

A penetration tester is conducting an external scan of a target network. The tester wants to avoid detection by an IDS that triggers on high volumes of packets from a single source. Which technique is most effective for reducing the packet rate while still scanning all desired ports?

A network administrator wants to reduce the effectiveness of external network scans against the company's public-facing servers. The administrator cannot change the IP addresses of the servers and must maintain legitimate remote access for administrators. Which countermeasure is most effective?

A junior penetration tester is about to scan a client's network. The client has provided a written authorization that includes the IP ranges to scan and the time window. Which additional step is most important before starting the scan?

Which technique hides services by requiring a specific sequence of connection attempts to open a port?

Keep studying — Reconnaissance Techniques