A security analyst is reviewing a list of open ports on a server: 22, 80, 443, and 3306. Which set of services is most likely running on these ports?

SSH, FTP, HTTPS, and PostgreSQL

A network administrator wants to inventory all hosts on a subnet that are running a web server. The administrator needs to identify which hosts have port 80 open. Which approach is the most efficient for this task?

Use OS fingerprinting on each host

Use banner grabbing on port 443 for each host

Perform a TCP connect scan on port 80 for each host in the subnet

Perform a full port scan on each host in the subnet

During an authorized assessment, a tester connects to a target's port 22 and receives the string 'SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.7'. The tester wants to confirm the exact service version and the underlying OS without sending additional packets to the target. Which action should the tester take?

Perform an active OS fingerprint using Nmap's -O flag.

Run Nmap with -sV to actively probe the service for a more accurate version.

Use a UDP scan on port 22 to verify the service version.

Record the banner as the service version and infer the OS family from the banner content.

A penetration tester is asked to determine the operating system of a target host without sending any packets directly to the target, to avoid detection by network monitoring. Which technique should the tester use?

Analyze captured traffic from a network tap

Connect to port 80 and read the HTTP Server header

EC-CouncilCertified Ethical Hacker

Domain 2Objective 5

Service and OS Discovery CEH Practice Questions (Page 1)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

8concepts

Questions 1–5

1application · medium
A security analyst is reviewing a list of open ports on a server: 22, 80, 443, and 3306. Which set of services is most likely running on these ports?
Select an answer first
2application · medium
A network administrator wants to inventory all hosts on a subnet that are running a web server. The administrator needs to identify which hosts have port 80 open. Which approach is the most efficient for this task?
Select an answer first
3application · medium
During an authorized assessment, a tester connects to a target's port 22 and receives the string 'SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.7'. The tester wants to confirm the exact service version and the underlying OS without sending additional packets to the target. Which action should the tester take?
Select an answer first
4foundation · easy
Which Nmap command performs a SYN scan, service version detection, and OS fingerprinting on a target?
Select an answer first
5application · medium
A penetration tester is asked to determine the operating system of a target host without sending any packets directly to the target, to avoid detection by network monitoring. Which technique should the tester use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Service and OS Discovery CEH Practice Questions (Page 1)

Questions 1–5

A security analyst is reviewing a list of open ports on a server: 22, 80, 443, and 3306. Which set of services is most likely running on these ports?

A network administrator wants to inventory all hosts on a subnet that are running a web server. The administrator needs to identify which hosts have port 80 open. Which approach is the most efficient for this task?

Which Nmap command performs a SYN scan, service version detection, and OS fingerprinting on a target?

A penetration tester is asked to determine the operating system of a target host without sending any packets directly to the target, to avoid detection by network monitoring. Which technique should the tester use?

Keep studying — Reconnaissance Techniques