What is the primary purpose of service version detection during a port scan?

To determine if the port is filtered by a firewall

To identify the operating system of the target

To determine the exact version of the software running on an open port

To find the MAC address of the target

A security consultant is scanning a target that has a service on port 443 that returns a generic banner that does not include a version number. The consultant needs to identify the exact service version. Which approach is most effective?

Use Nmap's -sV with the --version-intensity 9 option to perform more aggressive probing.

Use Nmap's -O option to fingerprint the OS and infer the service version.

Use a simple banner grab with netcat to read the banner.

Use a UDP scan on port 443 to see if the service responds differently.

EC-CouncilCertified Ethical Hacker

Domain 2Objective 5

Service and OS Discovery CEH Practice Questions (Page 2)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

8concepts

Questions 6–10

6application · medium
A junior penetration tester is asked to identify the services running on a target host. The tester runs nmap -sS <target> and obtains a list of open ports. What is the next step the tester should take to identify the specific service versions?
Select an answer first
7foundation · easy
What is the primary purpose of service version detection during a port scan?
Select an answer first
8expert · hard
A security consultant is scanning a target that has a service on port 443 that returns a generic banner that does not include a version number. The consultant needs to identify the exact service version. Which approach is most effective?
Select an answer first
9application · medium
A network administrator is troubleshooting a connectivity issue. The administrator suspects that a firewall is blocking inbound connections to a specific service. Which Nmap scan type is most useful for determining whether the firewall is dropping or rejecting packets?
Select an answer first
10foundation · easy
Which port number is commonly associated with the SSH service?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Service and OS Discovery CEH Practice Questions (Page 2)

Questions 6–10

A junior penetration tester is asked to identify the services running on a target host. The tester runs nmap -sS <target> and obtains a list of open ports. What is the next step the tester should take to identify the specific service versions?

What is the primary purpose of service version detection during a port scan?

A security consultant is scanning a target that has a service on port 443 that returns a generic banner that does not include a version number. The consultant needs to identify the exact service version. Which approach is most effective?

A network administrator is troubleshooting a connectivity issue. The administrator suspects that a firewall is blocking inbound connections to a specific service. Which Nmap scan type is most useful for determining whether the firewall is dropping or rejecting packets?

Which port number is commonly associated with the SSH service?

Keep studying — Reconnaissance Techniques