Scanning & Enumeration
34 practice questions with explanations — 15 free to try
PassNova has 34 Certified Ethical Hacker (CEH) practice questions on Scanning & Enumeration, each with a clear explanation. A 15-question taster is free with no sign-up; the full bank is part of PassNova Premium. Updated for 2026.
Scanning & Enumeration: example questions & answers
2 worked examples with answers and explanations below. Try 15 Certified Ethical Hacker (CEH) questions free in the browser; the full 34-question Scanning & Enumeration bank is part of PassNova Premium.
In the Nmap TCP three-way-handshake context, which scan type completes the full handshake and is therefore more likely to be logged by the target?
- ATCP connect scan (-sT)✓
- BFIN scan (-sF), which sends only a FIN flag
- CNull scan (-sN), which sets no TCP flags
- DSYN scan (-sS), which never completes the handshake
Answer: The TCP connect scan (-sT) uses the OS connect() call to complete the full three-way handshake, which is reliably logged, whereas a SYN scan never finishes the handshake.
Which Nmap option is used to attempt remote operating-system detection by analysing TCP/IP stack responses?
- A-O✓
- B-p-
- C-Pn
- D-sV
Answer: The -O flag enables Nmap OS detection, which fingerprints the target by comparing TCP/IP stack behaviour against a database of known signatures.