Certified Ethical Hacker Network Security and Scanning 1 — Questions and Answers
Question 1: What is the purpose of a SYN scan (half-open scan) in network reconnaissance?
- To identify open ports without completing the TCP handshake, making it stealthier (Correct answer)
- To establish a full connection to every port
- To flood the target with SYN packets
- To encrypt network traffic
Correct answer: To identify open ports without completing the TCP handshake, making it stealthier
A SYN scan sends SYN packets and analyzes responses (SYN-ACK = open, RST = closed) without completing the three-way handshake, making it faster and harder to detect than full connect scans.
Question 2: What is the difference between active and passive reconnaissance?
- Active directly interacts with the target system; passive gathers information without direct contact (Correct answer)
- Active uses automated tools; passive uses manual methods
- Active is legal; passive is illegal
- There is no practical difference
Correct answer: Active directly interacts with the target system; passive gathers information without direct contact
Active reconnaissance involves direct interaction with the target (port scanning, vulnerability scanning), while passive reconnaissance gathers publicly available information (WHOIS, social media, DNS records) without alerting the target.
Question 3: What is OS fingerprinting in ethical hacking?
- Identifying the target's operating system by analyzing network packet characteristics (Correct answer)
- Creating a digital fingerprint for biometric authentication
- Copying the target's operating system
- Scanning for fingerprint readers on the network
Correct answer: Identifying the target's operating system by analyzing network packet characteristics
OS fingerprinting analyzes unique characteristics of network packets (TTL values, TCP window size, DF bit) to identify the target's operating system and version, using tools like Nmap.
Question 4: What is a vulnerability assessment versus a penetration test?
- VA identifies vulnerabilities without exploitation; a pentest actively exploits vulnerabilities to prove impact (Correct answer)
- They are the same thing
- VA is more comprehensive than a pentest
- Pentests only test physical security
Correct answer: VA identifies vulnerabilities without exploitation; a pentest actively exploits vulnerabilities to prove impact
A vulnerability assessment scans and identifies potential security weaknesses, while a penetration test goes further by actively attempting to exploit discovered vulnerabilities to demonstrate real-world impact.
Question 5: What is banner grabbing and what information does it reveal?
- Connecting to services to capture their version information and software details (Correct answer)
- Creating advertising banners for websites
- Capturing screenshots of target websites
- Blocking banner advertisements
Correct answer: Connecting to services to capture their version information and software details
Banner grabbing connects to network services (HTTP, FTP, SMTP) and captures the service banner which typically reveals the software name, version, and sometimes OS information, helping identify exploitable vulnerabilities.
Question 6: What is the purpose of enumeration in the ethical hacking methodology?
- Extracting detailed information like usernames, shares, and services from a target system (Correct answer)
- Counting the number of computers on a network
- Numbering all ports sequentially
- Creating a network diagram automatically
Correct answer: Extracting detailed information like usernames, shares, and services from a target system
Enumeration involves establishing active connections to target systems to extract detailed information including user accounts, network shares, group memberships, SNMP data, and DNS zone transfers.
Certified Ethical Hacker Network Security and Scanning 1
What is the purpose of a SYN scan (half-open scan) in network reconnaissance?