During a penetration test, an analyst has discovered an open SNMP port on a network printer. The analyst needs to extract the printer's model and firmware version, but the community string is set to 'public'. Which tool is most appropriate?

Use Nmap's smb-enum-shares script

Use enum4linux to enumerate the printer

Use snmpwalk with the community string 'public' to query the MIB

Use a ping sweep to identify the printer

A network administrator is planning an authorized security assessment of a small office network. The administrator needs to identify all active hosts on the 192.168.1.0/24 subnet without performing a full port scan on every IP address, to minimize network traffic and avoid triggering intrusion detection alerts. Which approach is most efficient for this initial discovery phase?

Run a full TCP connect scan on all ports for each IP address

Run a UDP scan on all ports for each IP address

Run an OS fingerprinting scan on each IP address

Run a ping sweep using Nmap with the -sn option

During a red team exercise, a tester has gained a foothold on a Windows machine and needs to enumerate Active Directory users and groups to plan lateral movement. The tester has low-privilege credentials and wants to avoid generating excessive logs that might alert the blue team. Which approach is most effective?

Use LDAP queries with the tester's low-privilege credentials to enumerate users and groups

Use a ping sweep to identify domain controllers

Use enum4linux to enumerate users and shares

Use Nmap's smb-enum-users script against the domain controller

A penetration tester is assessing a network and discovers that a target Windows server has TCP port 445 open. The tester wants to enumerate the SMB shares and users on the server. Which tool is most appropriate for this task?

Use the nmap tool with the -sV option

EC-CouncilEthical Hacking Essentials

Domain 3Objective 2

Scanning and Enumeration Methodologies EHE Practice Questions (Page 5)

Part of the Ethical Hacking Methodology domain, which makes up ~12% of our current practice bank.

38questions here

8free pages

6concepts

Questions 21–25

21application · medium
A network engineer needs to identify which hosts on a large subnet are running a specific web server version. The engineer has a list of IP addresses and wants to quickly check if port 80 is open and then grab the server banner. Which Nmap command is most efficient?
Select an answer first
22expert · hard
During a penetration test, an analyst has discovered an open SNMP port on a network printer. The analyst needs to extract the printer's model and firmware version, but the community string is set to 'public'. Which tool is most appropriate?
Select an answer first
23application · medium
A network administrator is planning an authorized security assessment of a small office network. The administrator needs to identify all active hosts on the 192.168.1.0/24 subnet without performing a full port scan on every IP address, to minimize network traffic and avoid triggering intrusion detection alerts. Which approach is most efficient for this initial discovery phase?
Select an answer first
24expert · hard
During a red team exercise, a tester has gained a foothold on a Windows machine and needs to enumerate Active Directory users and groups to plan lateral movement. The tester has low-privilege credentials and wants to avoid generating excessive logs that might alert the blue team. Which approach is most effective?
Select an answer first
25application · medium
A penetration tester is assessing a network and discovers that a target Windows server has TCP port 445 open. The tester wants to enumerate the SMB shares and users on the server. Which tool is most appropriate for this task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to EHE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “EHE” is a trademark of its owner, used for identification only.

Scanning and Enumeration Methodologies EHE Practice Questions (Page 5)

Questions 21–25

A network engineer needs to identify which hosts on a large subnet are running a specific web server version. The engineer has a list of IP addresses and wants to quickly check if port 80 is open and then grab the server banner. Which Nmap command is most efficient?

During a penetration test, an analyst has discovered an open SNMP port on a network printer. The analyst needs to extract the printer's model and firmware version, but the community string is set to 'public'. Which tool is most appropriate?

A penetration tester is assessing a network and discovers that a target Windows server has TCP port 445 open. The tester wants to enumerate the SMB shares and users on the server. Which tool is most appropriate for this task?

Keep studying — Ethical Hacking Methodology