You are performing a host discovery scan against a target network that blocks all ICMP echo requests at the perimeter firewall. You need to identify live hosts, but you also want to avoid generating excessive traffic that could trigger rate-based alerts. Which Nmap option is most effective for host discovery in this environment?

nmap -PS80,443 -sn 192.168.1.0/24

A security consultant is performing an internal network assessment. The consultant needs to identify all active hosts on a local Ethernet segment, but the client has disabled ICMP echo replies on all workstations. Which host discovery technique is most reliable in this environment?

TCP SYN scan to port 80 on all IPs

A company wants to reduce the visibility of its internal services to external scanners while still allowing legitimate remote administrators to access SSH. They are considering port knocking. What is the primary security benefit of port knocking in this scenario?

It blocks all ICMP traffic to prevent host discovery

It encrypts the SSH traffic to prevent eavesdropping

It authenticates users before they can connect to SSH

It hides the SSH port from port scans by only opening it after a specific sequence of connection attempts

EC-CouncilCertified Ethical Hacker

Domain 2Objective 3

Network Scanning and Host Discovery CEH Practice Questions (Page 6)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 26–30

26foundation · easy
Which type of scanning is specifically used to identify weaknesses or misconfigurations in a system or network?
Select an answer first
27application · medium
You are performing a host discovery scan against a target network that blocks all ICMP echo requests at the perimeter firewall. You need to identify live hosts, but you also want to avoid generating excessive traffic that could trigger rate-based alerts. Which Nmap option is most effective for host discovery in this environment?
Select an answer first
28application · medium
A security consultant is performing an internal network assessment. The consultant needs to identify all active hosts on a local Ethernet segment, but the client has disabled ICMP echo replies on all workstations. Which host discovery technique is most reliable in this environment?
Select an answer first
29foundation · easy
A security analyst sends an ICMP Echo Request to a range of IP addresses and receives Echo Replies from some of them. What is this technique called?
Select an answer first
30application · medium
A company wants to reduce the visibility of its internal services to external scanners while still allowing legitimate remote administrators to access SSH. They are considering port knocking. What is the primary security benefit of port knocking in this scenario?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Network Scanning and Host Discovery CEH Practice Questions (Page 6)

Questions 26–30

Which type of scanning is specifically used to identify weaknesses or misconfigurations in a system or network?

A security consultant is performing an internal network assessment. The consultant needs to identify all active hosts on a local Ethernet segment, but the client has disabled ICMP echo replies on all workstations. Which host discovery technique is most reliable in this environment?

A security analyst sends an ICMP Echo Request to a range of IP addresses and receives Echo Replies from some of them. What is this technique called?

A company wants to reduce the visibility of its internal services to external scanners while still allowing legitimate remote administrators to access SSH. They are considering port knocking. What is the primary security benefit of port knocking in this scenario?

Keep studying — Reconnaissance Techniques