During a Windows domain penetration test, an analyst has gained access to a low-privilege account. The analyst needs to enumerate all domain users and their group memberships to identify potential privilege escalation paths. Which tool is most appropriate?

PowerShell with Active Directory module cmdlets like Get-ADUser and Get-ADGroupMember

Nmap with the smb-enum-users script

A security consultant is conducting an authorized external assessment of a client's network. The consultant needs to discover which hosts are reachable from the internet and which ports are open, but must minimize the chance of triggering intrusion detection systems. Which approach best balances stealth and information gathering?

Use a UDP scan with Nmap and the -T0 timing template

Perform a full TCP connect scan with Nmap using the -T5 timing template

Perform a slow SYN scan with Nmap using the -T2 timing template

Use a ping sweep with ICMP echo requests only

EC-CouncilEthical Hacking Essentials

Domain 3Objective 2

Scanning and Enumeration Methodologies EHE Practice Questions (Page 3)

Part of the Ethical Hacking Methodology domain, which makes up ~12% of our current practice bank.

38questions here

8free pages

6concepts

Questions 11–15

11application · medium
A penetration tester has discovered an open LDAP port on a directory server. The tester needs to enumerate the directory structure and extract user account information. Which tool is best suited for this task?
Select an answer first
12application · medium
During a Windows domain penetration test, an analyst has gained access to a low-privilege account. The analyst needs to enumerate all domain users and their group memberships to identify potential privilege escalation paths. Which tool is most appropriate?
Select an answer first
13foundation · easy
Which Nmap flag is used to perform a TCP SYN scan?
Select an answer first
14application · medium
A security consultant is conducting an authorized external assessment of a client's network. The consultant needs to discover which hosts are reachable from the internet and which ports are open, but must minimize the chance of triggering intrusion detection systems. Which approach best balances stealth and information gathering?
Select an answer first
15application · easy
A security analyst is conducting an authorized scan of a network and wants to determine the operating system of a target host. The analyst has already confirmed that the host is alive and has several open ports. Which Nmap option should the analyst use to perform OS fingerprinting?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to EHE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “EHE” is a trademark of its owner, used for identification only.

Scanning and Enumeration Methodologies EHE Practice Questions (Page 3)

Questions 11–15

A penetration tester has discovered an open LDAP port on a directory server. The tester needs to enumerate the directory structure and extract user account information. Which tool is best suited for this task?

During a Windows domain penetration test, an analyst has gained access to a low-privilege account. The analyst needs to enumerate all domain users and their group memberships to identify potential privilege escalation paths. Which tool is most appropriate?

Which Nmap flag is used to perform a TCP SYN scan?

A security analyst is conducting an authorized scan of a network and wants to determine the operating system of a target host. The analyst has already confirmed that the host is alive and has several open ports. Which Nmap option should the analyst use to perform OS fingerprinting?

Keep studying — Ethical Hacking Methodology