EC-COUNCIL CERTIFIED ETHICAL HACKER
PRACTICAL EXAM WITH QUESTIONS AND
VERIFIED ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
1. Network reconnaissance and service identification
During an authorized penetration test of a company’s internal lab
network, you discover a host at 192.168.10.25. You need to determine
which TCP ports are accessible and identify the services and versions
running on those ports. Which Nmap command is the MOST appropriate
initial choice?
A. nmap -sn 192.168.10.25
B. nmap -sV 192.168.10.25
C. nmap -O 192.168.10.25
D. nmap -sU 192.168.10.25
Answer: B. nmap -sV 192.168.10.25
Rationale: The -sV option enables service/version detection, allowing
the tester to identify services listening on discovered TCP ports and
attempt to determine their versions. -sn performs host discovery
without port scanning, -O focuses on OS detection, and -sU performs
UDP scanning. In a practical assessment, service/version information
is particularly useful for subsequent vulnerability assessment and
enumeration.
2. Host discovery
1
,A penetration tester is assessing the authorized subnet 10.10.20.0/24.
The tester wants to identify which systems are currently online before
performing more intensive enumeration. Which Nmap option is
designed specifically for host discovery without performing a normal
port scan?
A. -sS
B. -sV
C. -sn
D. -A
Answer: C. -sn
Rationale: The -sn option performs host discovery without a port scan.
It is useful during the initial discovery phase because it helps establish
which addresses appear to have active hosts before conducting deeper
enumeration. -sS performs a TCP SYN scan, -sV performs
service/version detection, and -A enables several advanced detection
capabilities.
3. SYN scanning
A security consultant is conducting an authorized assessment and wants
to identify open TCP ports while minimizing the amount of application-
level interaction generated by the scanner. Which Nmap scan is most
appropriate?
A. TCP SYN scan
B. UDP scan
C. TCP connect scan only
D. Ping sweep
Answer: A. TCP SYN scan
Rationale: A TCP SYN scan, invoked with -sS, sends SYN packets and
analyzes responses to determine port state without completing the
2
,normal TCP three-way handshake in the typical case. This makes it a
common technique for efficient TCP port discovery during authorized
penetration testing. A TCP connect scan completes the connection,
UDP scanning targets UDP services, and a ping sweep is primarily for
host discovery.
4. OS fingerprinting
During a CEH practical exercise, a tester has identified an active host
but does not know whether it is running Linux, Windows, or another
operating system. Which Nmap capability is specifically intended to
assist with this determination?
A. Service enumeration
B. OS detection
C. DNS enumeration
D. Banner grabbing only
Answer: B. OS detection
Rationale: Nmap's OS detection capability, commonly invoked using -
O, analyzes characteristics of network responses and compares them
with fingerprint databases to estimate the target operating system. This
information can help a penetration tester select appropriate follow-up
enumeration techniques.
5. Full enumeration
A tester wants a broad Nmap assessment that includes OS detection,
version detection, script scanning, and traceroute against an authorized
target. Which option is most appropriate?
A. -A
B. -Pn
3
, C. -F
D. -n
Answer: A. -A
Rationale: Nmap's -A option enables several advanced features,
including OS detection, version detection, script scanning, and
traceroute. It is therefore useful for comprehensive authorized
reconnaissance, although it generates considerably more traffic than a
simple host-discovery scan.
6. DNS reconnaissance
A tester has authorization to assess example.local. During
reconnaissance, the tester needs to determine which DNS records reveal
mail servers associated with the domain. Which DNS record type should
be examined?
A. A
B. MX
C. TXT
D. PTR
Answer: B. MX
Rationale: MX records identify mail-exchange servers responsible for
receiving email for a domain. A records map names to IPv4 addresses,
TXT records contain text-based information such as SPF-related data,
and PTR records are used for reverse DNS resolution.
7. DNS zone transfer assessment
A penetration tester discovers that a DNS server may permit
unauthorized zone transfers. Which DNS mechanism should be tested?
4
PRACTICAL EXAM WITH QUESTIONS AND
VERIFIED ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
1. Network reconnaissance and service identification
During an authorized penetration test of a company’s internal lab
network, you discover a host at 192.168.10.25. You need to determine
which TCP ports are accessible and identify the services and versions
running on those ports. Which Nmap command is the MOST appropriate
initial choice?
A. nmap -sn 192.168.10.25
B. nmap -sV 192.168.10.25
C. nmap -O 192.168.10.25
D. nmap -sU 192.168.10.25
Answer: B. nmap -sV 192.168.10.25
Rationale: The -sV option enables service/version detection, allowing
the tester to identify services listening on discovered TCP ports and
attempt to determine their versions. -sn performs host discovery
without port scanning, -O focuses on OS detection, and -sU performs
UDP scanning. In a practical assessment, service/version information
is particularly useful for subsequent vulnerability assessment and
enumeration.
2. Host discovery
1
,A penetration tester is assessing the authorized subnet 10.10.20.0/24.
The tester wants to identify which systems are currently online before
performing more intensive enumeration. Which Nmap option is
designed specifically for host discovery without performing a normal
port scan?
A. -sS
B. -sV
C. -sn
D. -A
Answer: C. -sn
Rationale: The -sn option performs host discovery without a port scan.
It is useful during the initial discovery phase because it helps establish
which addresses appear to have active hosts before conducting deeper
enumeration. -sS performs a TCP SYN scan, -sV performs
service/version detection, and -A enables several advanced detection
capabilities.
3. SYN scanning
A security consultant is conducting an authorized assessment and wants
to identify open TCP ports while minimizing the amount of application-
level interaction generated by the scanner. Which Nmap scan is most
appropriate?
A. TCP SYN scan
B. UDP scan
C. TCP connect scan only
D. Ping sweep
Answer: A. TCP SYN scan
Rationale: A TCP SYN scan, invoked with -sS, sends SYN packets and
analyzes responses to determine port state without completing the
2
,normal TCP three-way handshake in the typical case. This makes it a
common technique for efficient TCP port discovery during authorized
penetration testing. A TCP connect scan completes the connection,
UDP scanning targets UDP services, and a ping sweep is primarily for
host discovery.
4. OS fingerprinting
During a CEH practical exercise, a tester has identified an active host
but does not know whether it is running Linux, Windows, or another
operating system. Which Nmap capability is specifically intended to
assist with this determination?
A. Service enumeration
B. OS detection
C. DNS enumeration
D. Banner grabbing only
Answer: B. OS detection
Rationale: Nmap's OS detection capability, commonly invoked using -
O, analyzes characteristics of network responses and compares them
with fingerprint databases to estimate the target operating system. This
information can help a penetration tester select appropriate follow-up
enumeration techniques.
5. Full enumeration
A tester wants a broad Nmap assessment that includes OS detection,
version detection, script scanning, and traceroute against an authorized
target. Which option is most appropriate?
A. -A
B. -Pn
3
, C. -F
D. -n
Answer: A. -A
Rationale: Nmap's -A option enables several advanced features,
including OS detection, version detection, script scanning, and
traceroute. It is therefore useful for comprehensive authorized
reconnaissance, although it generates considerably more traffic than a
simple host-discovery scan.
6. DNS reconnaissance
A tester has authorization to assess example.local. During
reconnaissance, the tester needs to determine which DNS records reveal
mail servers associated with the domain. Which DNS record type should
be examined?
A. A
B. MX
C. TXT
D. PTR
Answer: B. MX
Rationale: MX records identify mail-exchange servers responsible for
receiving email for a domain. A records map names to IPv4 addresses,
TXT records contain text-based information such as SPF-related data,
and PTR records are used for reverse DNS resolution.
7. DNS zone transfer assessment
A penetration tester discovers that a DNS server may permit
unauthorized zone transfers. Which DNS mechanism should be tested?
4
