You are performing OS fingerprinting on a target that is behind a load balancer. The load balancer terminates TCP connections and forwards traffic to multiple backend servers. You need to identify the OS of the actual backend servers. Which approach is most effective?

Use banner grabbing on the load balancer's open ports

Use passive fingerprinting on traffic captured between the load balancer and backend servers

Run Nmap -O against the load balancer's IP

Use an idle scan through the load balancer

You are performing service version detection on a target that runs a custom application on a non-standard port. Nmap's -sV scan does not identify the service. You need to determine what the service is. Which approach is most effective?

Use netcat to connect to the port and manually interact with the service

Use Nmap's -sV with --version-intensity 9

Use Nmap's -O to fingerprint the OS and infer the service

A security analyst is performing an external assessment of a company's network. The analyst needs to identify the operating system of a public-facing server without sending any packets directly to the server. Which technique is most appropriate?

Send a series of TCP packets with different window sizes

Analyze the server's HTTP response headers from a web browser

Perform a UDP scan to identify open ports

Use Nmap's -O option to perform OS fingerprinting

You are scanning a target that sits behind a stateful firewall. You need to identify the operating system, but you want to minimize the risk of the scan being blocked. Which approach is most appropriate?

Use passive OS fingerprinting by capturing traffic from the target

Use a TCP connect scan to port 80 and read the Server header

Use an idle scan to bounce probes off a third-party host

Use Nmap's -O flag with default timing

EC-CouncilCertified Ethical Hacker

Domain 2Objective 3

Network Scanning and Host Discovery CEH Practice Questions (Page 8)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 36–40

36expert · hard
You are performing OS fingerprinting on a target that is behind a load balancer. The load balancer terminates TCP connections and forwards traffic to multiple backend servers. You need to identify the OS of the actual backend servers. Which approach is most effective?
Select an answer first
37foundation · easy
Which evasion technique uses a 'zombie' host with a predictable IP ID sequence to perform a scan while hiding the attacker's identity?
Select an answer first
38expert · hard
You are performing service version detection on a target that runs a custom application on a non-standard port. Nmap's -sV scan does not identify the service. You need to determine what the service is. Which approach is most effective?
Select an answer first
39application · medium
A security analyst is performing an external assessment of a company's network. The analyst needs to identify the operating system of a public-facing server without sending any packets directly to the server. Which technique is most appropriate?
Select an answer first
40application · medium
You are scanning a target that sits behind a stateful firewall. You need to identify the operating system, but you want to minimize the risk of the scan being blocked. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.