During an internal penetration test, a tester discovers an open TCP port 22 on a Linux server. The tester needs to determine the exact SSH server version to check for known vulnerabilities. Which technique is most appropriate?

Send a NULL TCP packet to the port

Connect to the port and read the banner

Run an ARP scan to identify the OS

During a web application penetration test, a tester discovers an open TCP port 443 on a target server. The tester needs to identify the web server software and version to look for known vulnerabilities. Which Nmap option is most appropriate for this task?

Run Nmap with -sn to perform a ping sweep

Run Nmap with -sV to perform service version detection

Run Nmap with -O to perform OS fingerprinting

Run Nmap with -sU to scan UDP ports

A penetration tester is scanning a target network that has an intrusion detection system (IDS) configured to alert on repeated connection attempts from a single IP address. The tester wants to perform a port scan while making it harder for the IDS to attribute the scan to the tester's real IP. Which technique is most effective?

Use a TCP connect scan (-sT) from the tester's IP

Use an ICMP echo scan (-PE) to identify live hosts

Use a UDP scan (-sU) with a single source IP

Use Nmap decoy scans (-D) with several spoofed IP addresses

EC-CouncilCertified Ethical Hacker

Domain 2Objective 3

Network Scanning and Host Discovery CEH Practice Questions (Page 4)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 16–20

16application · medium
During an internal penetration test, a tester discovers an open TCP port 22 on a Linux server. The tester needs to determine the exact SSH server version to check for known vulnerabilities. Which technique is most appropriate?
Select an answer first
17foundation · easy
What is the process of connecting to a service and reading its initial output, such as an SSH or FTP banner, to determine the service and version?
Select an answer first
18application · medium
During a web application penetration test, a tester discovers an open TCP port 443 on a target server. The tester needs to identify the web server software and version to look for known vulnerabilities. Which Nmap option is most appropriate for this task?
Select an answer first
19application · medium
A penetration tester is scanning a target network that has an intrusion detection system (IDS) configured to alert on repeated connection attempts from a single IP address. The tester wants to perform a port scan while making it harder for the IDS to attribute the scan to the tester's real IP. Which technique is most effective?
Select an answer first
20application · easy
During a scan of a web server, you discover that TCP port 443 is open. You need to determine the exact version of the web server software to look up known vulnerabilities. Which Nmap command provides the most comprehensive service and version information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Network Scanning and Host Discovery CEH Practice Questions (Page 4)

Questions 16–20

During an internal penetration test, a tester discovers an open TCP port 22 on a Linux server. The tester needs to determine the exact SSH server version to check for known vulnerabilities. Which technique is most appropriate?

What is the process of connecting to a service and reading its initial output, such as an SSH or FTP banner, to determine the service and version?

During a web application penetration test, a tester discovers an open TCP port 443 on a target server. The tester needs to identify the web server software and version to look for known vulnerabilities. Which Nmap option is most appropriate for this task?

During a scan of a web server, you discover that TCP port 443 is open. You need to determine the exact version of the web server software to look up known vulnerabilities. Which Nmap command provides the most comprehensive service and version information?

Keep studying — Reconnaissance Techniques