A network administrator wants to detect port scanning activity on the internal network. The administrator has a span port configured to receive all traffic to and from the DMZ servers. Which defensive measure is most effective for detecting a SYN scan?

Use a firewall rule to block all inbound TCP traffic

Disable ICMP echo replies on the servers

Enable NetFlow on the core switch and review flow records for many SYN packets to a single host

Configure an IDS to alert on a high rate of TCP SYN packets to multiple ports on the same host

A security administrator is responsible for protecting a critical server that is exposed to the internet. The administrator wants to detect port scans while minimizing false positives and not disrupting legitimate traffic. Which approach is most effective?

Deploy an IDS that uses a threshold-based alert for multiple connection attempts to different ports from the same source IP within a short time

Block all inbound traffic except for port 443

Use a honeypot to attract attackers

Enable logging on the firewall and review logs manually once a week

EC-CouncilCertified Ethical Hacker

Domain 2Objective 4

Port Scanning Techniques CEH Practice Questions (Page 1)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 1–5

1foundation · easy
An attacker sends a TCP packet with the FIN, URG, and PUSH flags set to a target port. Which scanning technique is being used?
Select an answer first
2application · medium
A security analyst is testing a network where a firewall is configured to drop all incoming TCP packets with the SYN flag set. The analyst still needs to identify which TCP ports are open. Which Nmap scan technique is most likely to succeed in this environment?
Select an answer first
3application · medium
A network administrator wants to detect port scanning activity on the internal network. The administrator has a span port configured to receive all traffic to and from the DMZ servers. Which defensive measure is most effective for detecting a SYN scan?
Select an answer first
4application · medium
A security tester is scanning a network where the firewall is configured to drop all inbound TCP packets that have the FIN, PSH, and URG flags set simultaneously. The tester wants to identify open TCP ports. Which Nmap scan type is specifically designed to use this flag combination and would be blocked by this firewall?
Select an answer first
5expert · hard
A security administrator is responsible for protecting a critical server that is exposed to the internet. The administrator wants to detect port scans while minimizing false positives and not disrupting legitimate traffic. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Port Scanning Techniques CEH Practice Questions (Page 1)

Questions 1–5

An attacker sends a TCP packet with the FIN, URG, and PUSH flags set to a target port. Which scanning technique is being used?

A security analyst is testing a network where a firewall is configured to drop all incoming TCP packets with the SYN flag set. The analyst still needs to identify which TCP ports are open. Which Nmap scan technique is most likely to succeed in this environment?

A network administrator wants to detect port scanning activity on the internal network. The administrator has a span port configured to receive all traffic to and from the DMZ servers. Which defensive measure is most effective for detecting a SYN scan?

A security administrator is responsible for protecting a critical server that is exposed to the internet. The administrator wants to detect port scans while minimizing false positives and not disrupting legitimate traffic. Which approach is most effective?

Keep studying — Reconnaissance Techniques