312-50 Question 60
Single answer▪ Network Scanning ConceptsDuring an authorized internal assessment, you need to identify live hosts in a /24 subnet before performing deeper enumeration. The network team tells you that perimeter and internal firewalls commonly block ICMP echo requests, but most Windows and Linux servers on the segment provide normal TCP services. You want a host discovery method that is more reliable than a simple ping sweep and does not require completing full TCP connections to every tested port. Which scanning approach is the BEST choice?
- A
Run an ICMP echo sweep only, because host discovery is designed to rely primarily on ping responses
- B
Use a TCP SYN ping/host discovery scan against common ports such as 80, 443, or 22
- C
Use a full TCP connect scan against every port on every host to determine whether each system is alive
- D
Use a UDP flood against common ports and treat any lack of response as proof that the host is down
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use TCP SYN-based host discovery against common service ports. In real-world network scanning, ICMP echo requests are frequently filtered by firewalls or disabled on hosts, so ethical hackers and penetration testers often use alternative discovery methods. TCP SYN probes are particularly useful because they can elicit SYN-ACK or RST responses that confirm a host is reachable, without completing a full connection. This makes them more efficient and less noisy than TCP connect scans for initial discovery. Nmap documentation and standard scanning practice support using host discovery options such as TCP SYN ping when ICMP is blocked. From a CEH perspective, this question tests practical understanding of how to adapt scanning techniques to filtering conditions rather than blindly relying on traditional ping sweeps.
- A. Incorrect.
This is incorrect because relying only on ICMP echo requests is often ineffective in real environments where firewalls or host-based filtering block ping. CEH candidates are expected to know that modern host discovery frequently uses multiple probe types, including TCP-based discovery, when ICMP is filtered.
- B. Correct.
This is correct because TCP SYN-based host discovery is commonly used when ICMP echo is blocked but systems still expose TCP services. Sending SYN probes to likely open ports such as 80, 443, or 22 can reveal live hosts without completing the full three-way handshake. This is a practical and efficient discovery technique reflected in tools such as Nmap host discovery methods.
- C. Incorrect.
This is incorrect because a full TCP connect scan can identify services, but it is not the best host discovery method for this scenario. It is noisier, slower, and completes connections, which creates more logs and traffic than necessary when the immediate goal is just to determine whether hosts are alive.
- D. Incorrect.
This is incorrect because a UDP flood is not an appropriate host discovery technique. It is disruptive, may violate engagement rules, and lack of response to UDP does not prove a host is down. UDP scanning logic is more nuanced, as open UDP ports often return no response, while closed ports may generate ICMP port unreachable messages.