Scanning Networks
20 practice questions under this official exam objective (312-50v12, 312-50v13), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
20 total · page 1 of 1What Follows a Completed TCP Handshake During Scanning?
This CEH 312-50v12 question tests what an ethical hacker does immediately after completing a TCP three-way handshake (SYN → SYN/ACK → ACK) with an ope
IDLE/IPID Header Scan IPID Increment Analysis
This question explores the interpretation of IP Identification (IPID) increments during an Nmap IDLE scan to determine target port status. It establis
ACK Flag Probe Scan for BSD TCP/IP Stack
This question addresses the use of ACK Flag Probe Scans to bypass SYN packet detection on BSD-derived TCP/IP stacks. The correct method exploits speci
Which Zenmap Scan Hides the Scanner's IP While Finding Open Ports?
The IDLE/IPID header scan (-sI) lets a CEH use a zombie host to scan a target's TCP ports without exposing the scanner's own IP address. This page exp
Comprehensive Network Scanning Sequence
Determines the correct sequence for network scanning using Nmap, Metasploit, and Hping3. The page establishes that D is the correct answer because it
Effective Host Discovery Behind Restrictive Firewalls
Determines the optimal host discovery technique for a LAN environment with restrictive firewalls. ARP Ping Scan is the correct answer because it opera
TCP Maimon Scan Technique Analysis
This page explains the TCP Maimon scan, a stealthy port scanning technique using FIN/ACK probes to detect closed ports via RST responses. It clarifies
OS Fingerprinting via SYN and ECN-Echo TCP Flags
This question examines TCP port scanning techniques used for OS fingerprinting, specifically identifying the test that utilizes SYN and ECN-Echo flags
Which Nmap Switch Helps Evade IDS or Firewalls?
Nmap's -D decoy switch mixes real scan traffic with spoofed decoy source addresses, making IDS and firewall logs much harder to attribute. This page c
Bypassing Detection on BSD TCP/IP Stack
This question examines stealth scanning techniques against BSD-derived TCP/IP stacks, specifically focusing on the ACK Flag Probe Scan. It establishes
Interpreting IPID Increment in Nmap IDLE Scans
This question explores the interpretation of IP Identification (IPID) header increments during an Nmap IDLE scan. An increment of 2 indicates that the
Which Zenmap Option Performs an ICMP Timestamp Ping Scan?
Zenmap's ICMP timestamp ping scan maps to Nmap's -PP host-discovery option, which asks the target for its current time. This page confirms C is the co
Hping3 IP Spoofing Command for Anonymity
Identifying the correct Hping3 command to spoof an IP address during network probing. This page establishes that the -a flag in Hping3 is the required
Host Discovery with Strict TCP Firewall Filtering
This question addresses host discovery techniques when a firewall enforces strict TCP filtering. It establishes that UDP Ping Scan is the preferred me
Hit-List Scanning Technique in Botnet Creation
This question identifies the hit-list scanning technique, where attackers pre-collect a list of vulnerable targets to efficiently spread botnets by di
Next Step After TCP Three-Way Handshake
This question tests the proper sequence of ethical hacking phases, specifically what follows the successful establishment of a TCP connection. The cor
Host Discovery with TCP SYN Ping Scan
This page explains why the TCP SYN Ping Scan is the correct host discovery technique for bypassing strict firewall filtering compared to ICMP or UDP m
Stealth Scanning with IDLE/IPID Technique in Zenmap
This question addresses how to perform network scanning while hiding the attacker's IP address using the IDLE scan technique (-sI) in Zenmap.
What Is the Purpose of wget -q -S Against a Web Server?
The wget -q -S command retrieves HTTP response headers while suppressing progress output, making it an HTTP banner-grabbing technique for identifying
UDP Traceroute to Bypass ICMP Blocking
This page explains how a Certified Ethical Hacker can use UDP Traceroute to map network paths when ICMP is blocked by firewalls. It establishes why op