A network administrator wants to detect port scans on the internal network. The administrator has a limited budget and cannot deploy new hardware. Which existing tool is most appropriate for this task?

Install a network intrusion detection system (IDS) on a spare server

Configure the existing firewall to log all dropped packets and review logs for patterns

Use a packet analyzer to capture all traffic on the network

Enable port knocking on all servers

You are scanning a target that is protected by an IPS which drops packets that match known Nmap scan signatures. You need to perform a TCP port scan that is less likely to be detected by the IPS. Which approach is most likely to succeed?

Use a custom script that sends TCP SYN packets with randomized source ports and delays

Use Nmap's -sF (FIN scan) with -f fragmentation

Use Nmap's -sT with -T2 for slow scanning

Use Nmap's -sS with -T5 for speed

EC-CouncilCertified Ethical Hacker

Domain 2Objective 3

Network Scanning and Host Discovery CEH Practice Questions (Page 7)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 31–35

31application · medium
A network administrator wants to detect port scans on the internal network. The administrator has a limited budget and cannot deploy new hardware. Which existing tool is most appropriate for this task?
Select an answer first
32application · easy
You are scanning a Unix/Linux target that is known to be vulnerable to certain TCP stack quirks. You want to perform a port scan that sends packets with the FIN, URG, and PUSH flags set, because you expect the target's TCP stack to respond differently to such packets. Which Nmap scan type should you use?
Select an answer first
33expert · hard
You are scanning a target that is protected by an IPS which drops packets that match known Nmap scan signatures. You need to perform a TCP port scan that is less likely to be detected by the IPS. Which approach is most likely to succeed?
Select an answer first
34application · medium
During an authorized penetration test, you need to discover which hosts on a 192.168.10.0/24 network are alive without completing TCP handshakes, because the client's IDS alerts on full connections. You also want to identify open TCP ports on the live hosts. Which Nmap scan type best satisfies both requirements while minimizing the chance of triggering the IDS?
Select an answer first
35foundation · easy
Which type of OS fingerprinting involves sending crafted packets to a target and analyzing the responses to determine the operating system?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Network Scanning and Host Discovery CEH Practice Questions (Page 7)

Questions 31–35

A network administrator wants to detect port scans on the internal network. The administrator has a limited budget and cannot deploy new hardware. Which existing tool is most appropriate for this task?

You are scanning a target that is protected by an IPS which drops packets that match known Nmap scan signatures. You need to perform a TCP port scan that is less likely to be detected by the IPS. Which approach is most likely to succeed?

Which type of OS fingerprinting involves sending crafted packets to a target and analyzing the responses to determine the operating system?

Keep studying — Reconnaissance Techniques