A penetration tester is conducting an authorized assessment of a network that has a stateful firewall. The firewall drops unsolicited inbound SYN packets but allows outbound connections. The tester needs to identify open TCP ports on an internal server, but the tester's machine is on the external network. The tester has a compromised host on the internal network that can initiate outbound connections. Which approach is most effective?

Use the compromised internal host to perform a TCP connect scan to the target server

Use a SYN scan from the external machine with the -g 53 option

Use a TCP connect scan from the external machine to the internal server

Use an ACK scan from the external machine to map the firewall rules

A network administrator wants to detect slow port scans that are spread over a long period to evade threshold-based IDS alerts. Which defensive measure is most effective?

Configure the IDS to use a longer time window for correlation

Use a stateful firewall to block all inbound traffic

Increase the IDS threshold to reduce false positives

A company wants to reduce the risk of port scanning by limiting the information that is exposed to the internet. The security team has decided to implement a defense-in-depth approach. Which combination of measures is most effective?

Disabling the firewall and relying on host-based security

Firewall rules that restrict inbound traffic to only necessary ports and an IDS that monitors for scan patterns

Using only network segmentation without monitoring

Encrypting all traffic with TLS

EC-CouncilCertified Ethical Hacker

Domain 2Objective 4

Port Scanning Techniques CEH Practice Questions (Page 8)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 36–40

36expert · hard
A penetration tester is conducting an authorized assessment of a network that has a stateful firewall. The firewall drops unsolicited inbound SYN packets but allows outbound connections. The tester needs to identify open TCP ports on an internal server, but the tester's machine is on the external network. The tester has a compromised host on the internal network that can initiate outbound connections. Which approach is most effective?
Select an answer first
37application · medium
A network administrator wants to detect slow port scans that are spread over a long period to evade threshold-based IDS alerts. Which defensive measure is most effective?
Select an answer first
38application · medium
A company wants to reduce the risk of port scanning by limiting the information that is exposed to the internet. The security team has decided to implement a defense-in-depth approach. Which combination of measures is most effective?
Select an answer first
39foundation · easy
Which port scanning technique completes a full TCP three-way handshake with the target?
Select an answer first
40application · medium
A penetration tester is assessing a remote Linux server that is protected by a stateful firewall. The firewall drops unsolicited inbound packets but allows established connections. The tester needs to determine which TCP ports are open without completing a full TCP handshake. Which Nmap scan type should the tester use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Port Scanning Techniques CEH Practice Questions (Page 8)

Questions 36–40

A network administrator wants to detect slow port scans that are spread over a long period to evade threshold-based IDS alerts. Which defensive measure is most effective?

A company wants to reduce the risk of port scanning by limiting the information that is exposed to the internet. The security team has decided to implement a defense-in-depth approach. Which combination of measures is most effective?

Which port scanning technique completes a full TCP three-way handshake with the target?

Keep studying — Reconnaissance Techniques