Service and OS Discovery CEH Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst is monitoring network traffic and wants to determine the operating system of an internal host that is communicating with a public web server. The analyst cannot send any packets to the internal host and must rely only on observed traffic. Which approach should the analyst use?

   • APassive OS fingerprinting by analyzing TCP/IP stack characteristics in captured packets.
   • BBanner grabbing from the web server's response headers.
   • CPort scanning the internal host to identify open ports and infer the OS.
   • DActive OS fingerprinting with Nmap's -O flag against the internal host.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which service is commonly associated with TCP port 443?

   • ATelnet
   • BHTTPS
   • CHTTP
   • DFTP
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A penetration tester is scanning a target that is behind a firewall. The firewall is configured to drop all ICMP traffic and to rate-limit incoming TCP SYN packets to 5 per second. The tester needs to identify open TCP ports and service versions without overwhelming the firewall or causing a denial of service. Which Nmap command is most appropriate?

   • Anmap -sS --scan-delay 1s -sV <target>
   • Bnmap -sS -T2 -sV <target>
   • Cnmap -sS -T5 -sV <target>
   • Dnmap -sT -T5 -sV <target>
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   During a service discovery scan, you find an open port 443 on a target. You need to determine if the service is HTTPS and what web server software is running. Which technique is most effective?

   • AConnect to port 443 with netcat and read the response
   • BUse nmap -sV -p 443 <target>
   • CUse nmap -O -p 443 <target>
   • DUse nmap -sS -p 443 <target>
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   During the reconnaissance phase, an ethical hacker performs service discovery on a target. What is the most direct outcome of this activity?

   • AA list of all user accounts on the target system
   • BA list of all installed applications on the target
   • CA list of all network shares and their permissions
   • DA list of open ports and the services associated with them
   Reveal Solution Discussion Select an answer first