A security analyst is scanning a target network that is behind a stateful firewall. The firewall only allows established connections and blocks unsolicited SYN packets. The analyst needs to discover open ports on a specific host. Which Nmap technique is most likely to succeed?

Use a SYN scan with the -Pn flag

Use a TCP connect scan with the -Pn flag

A penetration tester has discovered an open SMB port on a Windows server. The tester needs to enumerate users and shares, but the server has been hardened to disable null sessions and restrict anonymous access. Which approach is most likely to succeed?

Use enum4linux with default options

Use a valid low-privilege account to enumerate users and shares via SMB

Use Nmap's smb-enum-users script without credentials

Use a ping sweep to identify other hosts

A security analyst is performing an internal assessment and needs to enumerate services on a Linux server. The analyst has discovered that the server is running a database service on a non-standard port. The analyst needs to identify the exact database software and version. Which tool is most appropriate?

Use OS fingerprinting to identify the OS

Use Nmap with the -sV flag and specify the non-standard port

Use a ping sweep to confirm the host is alive

Use a UDP scan on the non-standard port

EC-CouncilEthical Hacking Essentials

Domain 3Objective 2

Scanning and Enumeration Methodologies EHE Practice Questions (Page 4)

Part of the Ethical Hacking Methodology domain, which makes up ~12% of our current practice bank.

38questions here

8free pages

6concepts

Questions 16–20

16expert · hard
A security analyst is scanning a target network that is behind a stateful firewall. The firewall only allows established connections and blocks unsolicited SYN packets. The analyst needs to discover open ports on a specific host. Which Nmap technique is most likely to succeed?
Select an answer first
17expert · hard
A penetration tester has discovered an open SMB port on a Windows server. The tester needs to enumerate users and shares, but the server has been hardened to disable null sessions and restrict anonymous access. Which approach is most likely to succeed?
Select an answer first
18expert · hard
A security analyst is performing an internal assessment and needs to enumerate services on a Linux server. The analyst has discovered that the server is running a database service on a non-standard port. The analyst needs to identify the exact database software and version. Which tool is most appropriate?
Select an answer first
19foundation · easy
Which enumeration technique is typically used to extract user account information from a Windows Active Directory environment?
Select an answer first
20application · easy
A security analyst is performing an authorized scan of a network and wants to identify all live hosts on a subnet without performing a port scan. Which Nmap option should the analyst use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to EHE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “EHE” is a trademark of its owner, used for identification only.

Scanning and Enumeration Methodologies EHE Practice Questions (Page 4)

Questions 16–20

A security analyst is scanning a target network that is behind a stateful firewall. The firewall only allows established connections and blocks unsolicited SYN packets. The analyst needs to discover open ports on a specific host. Which Nmap technique is most likely to succeed?

A penetration tester has discovered an open SMB port on a Windows server. The tester needs to enumerate users and shares, but the server has been hardened to disable null sessions and restrict anonymous access. Which approach is most likely to succeed?

Which enumeration technique is typically used to extract user account information from a Windows Active Directory environment?

A security analyst is performing an authorized scan of a network and wants to identify all live hosts on a subnet without performing a port scan. Which Nmap option should the analyst use?

Keep studying — Ethical Hacking Methodology