A security team wants to reduce the risk of port scanning from external attackers. They have a web server that must remain accessible on ports 80 and 443. Which defensive measure is most effective at limiting the information an external scanner can gather?

Disable the web server's response to ping

Block all inbound traffic except ports 80 and 443 at the firewall

Use a reverse proxy that only forwards traffic to the web server

Set the web server to only respond to SYN packets from known IP addresses

A security analyst is using Nmap to scan a target that is behind a firewall that rate-limits incoming packets. The analyst wants to avoid being blocked by the rate limiter while still completing the scan. Which Nmap option should the analyst use?

--scan-delay 1s (add a delay between probes)

EC-CouncilCertified Ethical Hacker

Domain 2Objective 4

Port Scanning Techniques CEH Practice Questions (Page 7)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 31–35

31application · medium
An ethical hacker is performing a port scan against a target network that uses an intrusion detection system (IDS) configured to alert on repeated SYN packets from a single source IP. The tester wants to reduce the chance of triggering the IDS while still obtaining accurate open-port information. Which Nmap option should be used?
Select an answer first
32application · medium
A security team wants to reduce the risk of port scanning from external attackers. They have a web server that must remain accessible on ports 80 and 443. Which defensive measure is most effective at limiting the information an external scanner can gather?
Select an answer first
33foundation · easy
In the TCP three-way handshake, what is the correct sequence of flags exchanged to establish a connection?
Select an answer first
34application · medium
A security analyst is using Nmap to scan a target that is behind a firewall that rate-limits incoming packets. The analyst wants to avoid being blocked by the rate limiter while still completing the scan. Which Nmap option should the analyst use?
Select an answer first
35application · medium
A security analyst is conducting a port scan of a target network and wants to avoid detection by making the scan appear to come from multiple different IP addresses. The analyst also wants to ensure that the scan is fast. Which Nmap command best achieves this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Port Scanning Techniques CEH Practice Questions (Page 7)

Questions 31–35

A security team wants to reduce the risk of port scanning from external attackers. They have a web server that must remain accessible on ports 80 and 443. Which defensive measure is most effective at limiting the information an external scanner can gather?

In the TCP three-way handshake, what is the correct sequence of flags exchanged to establish a connection?

A security analyst is using Nmap to scan a target that is behind a firewall that rate-limits incoming packets. The analyst wants to avoid being blocked by the rate limiter while still completing the scan. Which Nmap option should the analyst use?

A security analyst is conducting a port scan of a target network and wants to avoid detection by making the scan appear to come from multiple different IP addresses. The analyst also wants to ensure that the scan is fast. Which Nmap command best achieves this?

Keep studying — Reconnaissance Techniques