A security consultant is performing an assessment of a network that contains both Windows and Linux hosts. The consultant needs to identify the OS of each host without being detected by the network's intrusion prevention system (IPS), which is known to block scans that use common OS fingerprinting probes. Which approach is most likely to succeed?

Use nmap -sV to infer the OS from service banners

Use nmap -O with a slow timing template

Use nmap -O with decoys to hide the source

Use nmap -O with fragmented packets

What is the purpose of using decoy scans in Nmap?

To increase the speed of the scan

To hide the attacker's real IP address by spoofing multiple source addresses

EC-CouncilCertified Ethical Hacker

Domain 2Objective 5

Service and OS Discovery CEH Practice Questions (Page 7)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

8concepts

Questions 31–35

31foundation · easy
Which evasion technique involves splitting the scan packets into smaller fragments to avoid detection by network filters?
Select an answer first
32application · medium
During an authorized external assessment, you need to scan a target network. The client's IDS is known to trigger on rapid sequential port scans from a single IP. Which Nmap option is most effective at reducing the chance of triggering the IDS while still completing the scan?
Select an answer first
33expert · hard
A security consultant is performing an assessment of a network that contains both Windows and Linux hosts. The consultant needs to identify the OS of each host without being detected by the network's intrusion prevention system (IPS), which is known to block scans that use common OS fingerprinting probes. Which approach is most likely to succeed?
Select an answer first
34foundation · easy
What is the purpose of using decoy scans in Nmap?
Select an answer first
35application · medium
A security analyst is performing an authorized assessment of a DMZ host. The analyst needs to identify which TCP services are listening without completing full TCP handshakes, to minimize the chance of the target logging the connection. Which Nmap scan type should the analyst use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Service and OS Discovery CEH Practice Questions (Page 7)

Questions 31–35

Which evasion technique involves splitting the scan packets into smaller fragments to avoid detection by network filters?

During an authorized external assessment, you need to scan a target network. The client's IDS is known to trigger on rapid sequential port scans from a single IP. Which Nmap option is most effective at reducing the chance of triggering the IDS while still completing the scan?

What is the purpose of using decoy scans in Nmap?

A security analyst is performing an authorized assessment of a DMZ host. The analyst needs to identify which TCP services are listening without completing full TCP handshakes, to minimize the chance of the target logging the connection. Which Nmap scan type should the analyst use?

Keep studying — Reconnaissance Techniques