Back to Certified Ethical Hacker (CEH)

Scanning Networks

Identifying live hosts, ports, and services.

Focuses on the concepts and tools used to scan for active hosts, detect open ports and services, and gather details on the target system’s OS and network topology.
5 minutes 5 Questions

Scanning Networks is a critical phase in ethical hacking engagements where the penetration tester systematically examines network topology, identifies active systems, and discovers potential vulnerabilities. This process follows the initial footprinting phase and provides detailed technical intelli…

Concepts covered: Scanning Tools, Network Scanning Concepts, Host Discovery, Port and Service Discovery, OS Discovery (Banner Grabbing/OS Fingerprinting), Scanning Beyond IDS and Firewall, Draw Network Diagrams

Test mode:
Start practice test
CEH - Scanning Networks Example Questions

Test your knowledge of Scanning Networks

Question 1

You are performing a penetration test against a multinational corporation that has implemented a multi-layered security architecture. Their network is protected by an advanced next-generation firewall with application visibility and a signature-based IDS that monitors all traffic. Your initial scans using standard tools were detected and blocked. The organization also employs security analysts who review suspicious activities daily. You need to map their internal network structure while remaining undetected. The network team mentioned they have implemented rate limiting for all external connections. Which approach would be most effective for scanning beyond these security controls?

Correct Answer: Use a low-bandwidth, time-delayed scan spread across multiple source IP addresses to avoid triggering rate limit alarms

The best approach to scan a network with a multi-layered security architecture while remaining undetected is to use a low-bandwidth, time-delayed scan spread across multiple source IP addresses. This method is effective because: 1. Low-bandwidth scans are less likely to trigger rate limiting alerts that the question mentions are in place 2. Time-delays between probe packets help avoid pattern detection by the IDS 3. Multiple source IP addresses distribute the scanning activity, making it harder to correlate as a single coordinated attack 4. This approach is subtle enough to potentially fly under the radar of the daily security analyst reviews The decoy scan technique that mixes real and spoofed addresses is problematic because next-generation firewalls can often distinguish between legitimate and spoofed traffic, and this still reveals your actual IP address. The FIN scan with fragmented packets approach may be detected by modern security tools that can reassemble fragments and identify scan patterns, plus next-generation firewalls specifically look for these evasion techniques. Launching a coordinated scan using multiple compromised systems is unethical and illegal. As a Certified Ethical Hacker, using compromised systems goes beyond the scope of authorized testing and violates professional ethics. Additionally, establishing a command and control server introduces significant legal risks and exceeds the boundaries of ethical penetration testing.

Question 2

You are a security consultant hired to conduct a security assessment of a hospital's network infrastructure. The hospital's IT director suspects that unauthorized devices may have been connected to their network. During your assessment, you connect to the network and run a script that sends custom TCP packets with specific TCP window sizes, TTL values, and TCP options to devices on the network. The script then analyzes the responses to identify the operating systems. What is this technique called and why is it valuable in this scenario?

Correct Answer: Active OS fingerprinting - it helps identify unauthorized or unpatched systems that might have security vulnerabilities specific to their operating system.

The technique described in the question is Active OS fingerprinting. This technique involves sending specially crafted packets to target systems and analyzing their responses to determine the operating system. The custom TCP packets with specific window sizes, TTL values, and TCP options mentioned in the question are classic indicators of OS fingerprinting. In this hospital scenario, Active OS fingerprinting is valuable because it helps identify unauthorized devices on the network by determining their operating systems. This allows the security consultant to discover systems that might not be part of the approved hospital inventory and could potentially introduce security risks. The other options are incorrect: Service enumeration focuses on identifying services running on systems rather than identifying the operating systems themselves. While useful, this isn't what the described technique is doing. Active banner grabbing is about retrieving information from services running on systems, typically by connecting to them and collecting version information or other details from response headers. The question describes analyzing TCP/IP stack behaviors, not application-level responses. TCP/IP stack profiling is close but not the precise technique being described. While OS fingerprinting does analyze TCP/IP stack behavior, the term "TCP/IP stack profiling" isn't the standard terminology for this specific security technique.

Question 3

During banner grabbing, a security analyst observes the following response from a server: "Server: Apache/2.4.41 (Ubuntu) OpenSSL/1.1.1c". What type of information would this be most valuable for?

Correct Answer: Operating system and service version enumeration

The correct answer is "Operating system and service version enumeration." The server response "Server: Apache/2.4.41 (Ubuntu) OpenSSL/1.1.1c" reveals specific information about the server's software stack, including: 1. Web server software and version (Apache/2.4.41) 2. Operating system (Ubuntu) 3. SSL implementation and version (OpenSSL/1.1.1c) This information is extremely valuable for enumeration during the reconnaissance phase of penetration testing. With these specific version details, an attacker could research known vulnerabilities in these exact versions to plan targeted attacks. The other options are incorrect: "Password hash extraction and credential harvesting" - Banner information does not provide password hashes or credentials. These would require different attack vectors. "Network topology mapping and understanding the complete infrastructure" - While banner information provides details about a specific server, it doesn't reveal the broader network topology or infrastructure layout. "Session cookie analysis for authentication vulnerabilities" - Banner grabbing reveals server software versions, not session cookie information or authentication mechanisms.

More Scanning Networks questions
102 questions (total)
Start 100 question test