CEH Reconnaissance Techniques: 84 practice questions

12 of the 84 Reconnaissance Techniques questions in the Certsqill CEH bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CEH? Take the free 5-min readiness check →

1. Maltego: Which OSINT tool is best suited for this task?

1. theHarvester

   Incorrect. theHarvester collects emails, subdomains, and IP addresses from public sources but outputs a flat list — it does not provide relationship mapping or graph visualization.
2. Recon-ng

   Incorrect. Recon-ng is a modular OSINT framework for gathering data but its output is tabular/database-oriented, not visual relationship graphs.
3. Maltego ✓

   Correct. Maltego is specifically designed to visualize relationships between entities (people, domains, IP addresses, organizations) through graph-based link analysis using 'transforms'.
4. Shodan

   Incorrect. Shodan is an internet-connected device search engine. It reveals exposed devices and services but does not map human/organizational relationships.

Maltego uses 'transforms' to query data sources and displays results as an interactive relationship graph, making it ideal for mapping people-to-organization-to-infrastructure links.

2. MX: Which DNS record type should they query?

1. A

   Incorrect. A records map a hostname to an IPv4 address. Querying an A record for 'example.com' returns the web server IP, not mail server information.
2. TXT

   Incorrect. TXT records store arbitrary text, often SPF policies or domain verification strings. They don't directly identify mail servers by hostname.
3. CNAME

   Incorrect. CNAME records create aliases from one hostname to another. They are used for subdomains, not for identifying mail servers.
4. MX ✓

   Correct. MX (Mail Exchanger) records specify the mail servers responsible for receiving email for a domain, along with their priority values.

MX records map a domain to its designated mail server hostnames. Querying MX reveals mail infrastructure that may be separately secured from web-facing systems.

3. Shodan: Without touching the target systems, which tool is most appropriate?

1. Shodan ✓

   Correct. Shodan continuously scans the internet and indexes banners from devices, including industrial control systems. Operators can search by organization, banner content, firmware version, or device type without touching the target.
2. Nmap

   Incorrect. Nmap requires sending packets directly to the target — it is an active tool, not a passive OSINT source. Using it without authorization would touch the target network.
3. Metasploit

   Incorrect. Metasploit is an exploitation framework, not an OSINT tool. It does not index internet devices passively.
4. theHarvester

   Incorrect. theHarvester collects email addresses, subdomains, and open ports from search engines and APIs. It is not designed to search for specific device firmware versions or SCADA systems.

Shodan indexes banners from internet-connected devices and allows filtering by organization, product, version, and device type — making it ideal for passive discovery of exposed industrial systems.

4. It sends SYN packets and marks a port as open if a SYN-ACK: Which statement BEST describes the behavior of thi

1. It sends UDP datagrams to each port and waits for ICMP Port Unreachable responses.

   Incorrect. UDP scanning is performed with the -sU flag, not -sS. TCP SYN scan (-sS) does not use UDP.
2. It sends SYN packets and marks a port as open if a SYN-ACK is received, without completing the TCP three-way handshake. ✓

   Correct. The -sS flag performs a TCP SYN (half-open) scan. Nmap sends a SYN, receives a SYN-ACK for open ports, then sends RST to tear down — the full TCP connection is never established, making it stealthier than a full connect scan.
3. It completes the full TCP three-way handshake to confirm each open port.

   Incorrect. A full TCP connect scan is performed with -sT, not -sS. The -sS scan is specifically designed to avoid completing the handshake.
4. It sends packets with no flags set and interprets the lack of response as an open port.

   Incorrect. Sending packets with no flags is a NULL scan (-sN). A closed port responds with RST; open/filtered ports don't respond. This is fundamentally different from -sS behavior.

Nmap -sS is the TCP SYN (half-open) scan: it sends SYN, reads the response, but never completes the handshake — making it faster and harder to log than a full connect scan.

5. Passive OS fingerprinting by analyzing captured network: Which technique should the analyst use?

1. Passive OS fingerprinting by analyzing captured network traffic ✓

   Correct. Passive fingerprinting analyzes traffic already flowing through the network (e.g., TCP window sizes, TTL values, TCP options in headers) to infer OS without sending probe packets.
2. Active OS fingerprinting using Nmap's -O flag

   Incorrect. Nmap -O performs active fingerprinting by sending specially crafted probe packets to the target. This directly touches the target, violating the 'no packets to target' requirement.
3. Banner grabbing using Telnet to port 80

   Incorrect. Banner grabbing connects to the target service and reads the returned banner — this is an active technique requiring a direct connection to the target.
4. Running Nessus with full credential scanning enabled

   Incorrect. Nessus credentialed scanning sends packets and authentication attempts to the target — it is highly active and would generate significant target-side logs.

Passive OS fingerprinting analyzes traffic characteristics (TTL, window size, TCP options) of existing network flows without generating new probe traffic toward the target.

6. The NetBIOS name table of the remote system: What information can they expect to retrieve?

1. The NetBIOS name table of the remote system, including computer name, domain/workgroup, and MAC address ✓

   Correct. `nbtstat -A <IP>` queries the remote machine's NetBIOS name table, returning registered names (computer, domain, services) and the adapter's MAC address.
2. A list of all open TCP and UDP ports on the target

   Incorrect. Open port enumeration is performed by Nmap or similar port scanners, not nbtstat. nbtstat is specific to NetBIOS over TCP/IP.
3. The target's Active Directory domain controller information

   Incorrect. Domain controller enumeration requires LDAP queries (e.g., ldapsearch or nltest). nbtstat provides NetBIOS-layer names, not full AD topology.
4. SNMP community strings configured on the target

   Incorrect. SNMP community strings are retrieved via UDP port 161 using tools like snmpwalk or onesixtyone, not nbtstat.

nbtstat -A <IP> retrieves the remote NetBIOS name table, exposing the machine name, workgroup/domain, and MAC address — useful for network mapping and lateral movement planning.

7. Default or well-known SNMP community strings left: What vulnerability are they exploiting?

1. Default or well-known SNMP community strings (e.g., 'public', 'private') left unchanged ✓

   Correct. onesixtyone is an SNMP scanner that brute-forces community strings. Many devices ship with default community strings 'public' (read) and 'private' (read/write) that administrators fail to change.
2. A buffer overflow in the SNMP daemon

   Incorrect. onesixtyone performs authentication brute-forcing, not buffer overflow exploitation. It does not send malformed packets to trigger memory corruption.
3. Lack of encryption in SNMP v3

   Incorrect. SNMP v3 supports encryption (DES/AES) and authentication. The vulnerability exploited by onesixtyone is weak/default community strings, which is a feature of SNMPv1/v2c — not an SNMPv3 weakness.
4. Open UDP port 162 on network devices

   Incorrect. Port 162 is the SNMP trap receiver port. SNMP enumeration uses UDP port 161 (the SNMP agent port). Port 162 being open does not enable the described attack.

onesixtyone brute-forces SNMP community strings. Default strings like 'public' and 'private' are widely unchanged, allowing attackers to enumerate system info, routing tables, and running processes.

8. User account names: Which of the following information is most likely retrievable?

1. User account names, email addresses, and group memberships from Active Directory ✓

   Correct. LDAP on port 389 exposes Active Directory objects. Many AD configurations allow anonymous (unauthenticated) reads of user attributes including usernames, emails, department, and group memberships.
2. Password hashes for all domain user accounts

   Incorrect. LDAP does not expose password hashes — passwords are stored as non-readable attributes (unicodePwd) in AD and require privileged access (DCSync or direct NTDS.dit extraction) to retrieve.
3. ARP tables and MAC address assignments for the domain network

   Incorrect. ARP tables are Layer 2 data maintained by network switches and host OS network stacks. LDAP is an application-layer directory service that does not contain network infrastructure data.
4. Firewall rules configured on the domain controller

   Incorrect. Firewall rules are stored in system configuration (Windows Firewall, GPO), not in the LDAP directory schema. LDAP queries return directory objects, not system configurations.

Anonymous LDAP queries against Active Directory can enumerate user accounts, email addresses, group memberships, and organizational structure without credentials.

9. Dumpster diving: This reconnaissance technique is called:

1. Dumpster diving ✓

   Correct. Dumpster diving is the practice of searching through physical waste to find valuable information such as documents, org charts, credentials, or hardware that can aid an attack.
2. Tailgating

   Incorrect. Tailgating (or piggybacking) is physically following an authorized person through a secure entrance without authentication — it is a physical intrusion technique, not information gathering from waste.
3. Shoulder surfing

   Incorrect. Shoulder surfing involves observing a target's screen or keyboard input by looking over their shoulder. It requires proximity to a working individual, not searching through discarded materials.
4. Vishing

   Incorrect. Vishing uses voice calls (phone, VoIP) to socially engineer targets into revealing information. Searching trash bins is a physical, not voice-based, technique.

Dumpster diving involves searching through discarded materials (trash, recycling bins) to recover information useful for attack planning — documents, org charts, hardware, and credentials.

10. Nmap mixes the scan traffic with packets from 10 randomly: What is the effect of the -D RND:10 flag?

1. Nmap reduces the scan speed by introducing random delays between probes

   Incorrect. Timing control is handled by the -T flag (T0–T5) and --scan-delay. The -D flag is specifically for IP decoys, not timing manipulation.
2. Nmap mixes the scan traffic with packets from 10 randomly generated spoofed IP addresses, making it harder for the target to identify the true scanner ✓

   Correct. The -D flag enables decoy scanning. RND:10 generates 10 random spoofed source IPs. Nmap sends packets from all IPs (real + decoys), forcing the target's IDS to analyze 11 apparent sources rather than one.
3. Nmap sends the scan from a proxy chain of 10 intermediate hosts

   Incorrect. Proxy routing (e.g., --proxies or Proxychains) routes packets through intermediate hosts. -D generates spoofed source IPs in the same packets — decoys don't route traffic, they forge source addresses.
4. Nmap randomizes the order in which ports are scanned

   Incorrect. Port order randomization is the default Nmap behavior (or can be disabled with -r). The -D flag adds IP decoys to confuse source identification, unrelated to port scan ordering.

Nmap -D RND:10 sends scan packets from 10 random spoofed IPs alongside the real scanner's IP, making it difficult for the target to identify the true source of the scan.

11. Unrestricted DNS zone transfer: What vulnerability has the penetration tester exploited?

1. DNSSEC misconfiguration

   Incorrect. DNSSEC adds cryptographic signatures to DNS records for authentication. DNSSEC misconfigurations affect record validation, not zone transfer access control.
2. DNS cache poisoning

   Incorrect. DNS cache poisoning injects forged DNS records into a resolver's cache to redirect queries to attacker-controlled IPs. Zone transfer (AXFR) is a legitimate DNS synchronization mechanism that is misconfigured to be publicly accessible.
3. DNS subdomain brute-forcing

   Incorrect. Subdomain brute-forcing tries common subdomain names (mail, www, vpn, etc.) one by one. AXFR returns the complete zone file in a single query — far more comprehensive and faster.
4. Unrestricted DNS zone transfer (AXFR) ✓

   Correct. A successful AXFR zone transfer occurs when a DNS server is misconfigured to allow zone transfers to any host rather than only to authorized secondary DNS servers. This reveals the complete DNS zone database.

An unrestricted AXFR zone transfer allows any host to download the complete DNS zone database, revealing all internal hostnames, IPs, and network structure.

12. Email addresses: Which of the following data types does theHarvester PRIMARILY collect?

1. Email addresses, subdomains, IP addresses, and employee names from public sources ✓

   Correct. theHarvester is designed to collect email addresses, hostnames, subdomains, IP addresses, and employee names by querying public sources including search engines, LinkedIn, Shodan, and DNS records.
2. Physical addresses, phone numbers, and corporate registration documents

   Incorrect. Physical addresses and corporate registration data require separate OSINT tools (e.g., WHOIS, LinkedIn, SEC filings). theHarvester focuses on internet-infrastructure-oriented intelligence.
3. SSL certificate details and web server version banners

   Incorrect. SSL certificate enumeration (via Certificate Transparency logs) and banner grabbing are functions of tools like crt.sh, SSLScan, and Nmap banner scripts — not theHarvester's primary scope.
4. Open port lists and running service versions for a target IP range

   Incorrect. Port scanning and service enumeration are active techniques performed by Nmap. theHarvester is a passive OSINT tool that queries public data sources.

theHarvester queries search engines and public sources to collect emails, subdomains, IP addresses, and employee names — making it a rapid passive footprinting tool.

Other CEH domains

• Web Application Hacking — 100 questions →
• System Hacking Phases and Attack Techniques — 96 questions →
• Network and Perimeter Hacking — 81 questions →
• Mobile Platform, IoT, and OT Hacking — 38 questions →
• Cryptography — 35 questions →
• All 498 CEH questions →