EC-CouncilCertified Ethical Hacker
Domain 2Objective 5
Service and OS Discovery CEH Practice Questions (Page 8)
Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)
40questions here
8free pages
8concepts
Questions 36–40
- 36
Which port scanning technique completes a full TCP three-way handshake with the target?
Select an answer first - 37
What is a characteristic of a SYN scan compared to a TCP connect scan?
Select an answer first - 38
A penetration tester is performing a discovery scan on a target that has an intrusion prevention system (IPS) that blocks scans that appear to come from a single source. The tester wants to complete a SYN scan while making it harder for the IPS to correlate the traffic. Which Nmap option is most effective?
Select an answer first - 39
What is the main difference between active and passive OS fingerprinting?
Select an answer first - 40
Which technique is commonly used to identify the version of a service running on an open port?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
No more pagesBack to CEH
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.