The Cybersecurity Trail

A path to cyber mastery

EC-Council CEH Practice Tests

CEH v13 Domain 2.2 Practice Test 002

ByThe Test Master

Apr 16, 2026 #CEH, #EC-Council, #scanning techniques

Welcome to this CEH v13 practice test!

This practice test covers Domain 2 (Reconnaissance Techniques) Subdomain 2 (Scanning Techniques) from the CEH v13 (312-50v13) exam blueprint (v5).

These questions are inspired by the EC-Council CEH exam and are designed to help you test your knowledge of ethical hacking tools, techniques, and methodologies. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CEH exam.

Note: CEH and Certified Ethical Hacker are registered trademarks of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CEH practice tests based on specific domains and subdomains, click that link.

CEH v13 Domain 2.2 Practice Test 002
10 questions • 8 single-answer, 2 multi-select
CEH v13 (312-50v13) • Domain 2: Reconnaissance Techniques — Sub-Domain 2.2: Scanning Networks
Question 1
A penetration tester runs an Nmap scan using the '-sS' option against a target network. The scan sends SYN packets but does not complete the TCP handshake. What type of scan is being performed and why is it commonly used?
    Question 2
    During a network scan, a tester sends packets with FIN, PSH, and URG flags set. The tester analyzes responses to determine open ports on a target system. What type of scan is this?
      Question 3
      An ethical hacker wants to determine which hosts are active on a network without triggering IDS alerts. The hacker uses ICMP echo requests and ARP requests carefully. What phase of scanning is being performed?
        Question 4
        A tester runs Nmap with the '-O' option to identify the operating system of a target machine. What technique is Nmap using to determine the OS?
          Question 5
          During a scan, a tester sends packets with no flags set to the target system. Closed ports respond with RST, while open ports give no response. What type of scan is this?
            Question 6
            Select all that apply
            A penetration tester is using Nmap to perform stealth scanning. Which TWO scan types are considered stealthy and can evade basic logging? (Choose two)
              Question 7
              A tester uses the tool Hping3 to craft custom TCP packets for scanning and firewall testing. What advantage does Hping3 provide over traditional scanning tools?
                Question 8
                An analyst observes repeated SYN packets sent to multiple ports on a target system without completing the handshake. What activity is most likely occurring?
                  Question 9
                  A penetration tester uses a tool to scan UDP ports on a target system. The tester notices that many ports return no response, making results difficult to interpret. Why are UDP scans challenging?
                    Question 10
                    Select all that apply
                    During network scanning, which TWO pieces of information are typically identified during service enumeration? (Choose two)
                      Answered: 0/10

                      Related Post

                      EC-Council CEH Practice Tests

                      CEH v13 Domain 2.1 Practice Test 002

                      EC-Council CEH Practice Tests

                      CEH v13 Domain 1.1 Practice Test 002

                      EC-Council CEH Practice Tests

                      CEH v13 Domain 9.1 Practice Test 001

                      Leave a Reply

                      Your email address will not be published. Required fields are marked *

                      You missed

                      EC-Council CEH Practice Tests

                      CEH v13 Domain 2.2 Practice Test 002

                      April 16, 2026 The Test Master
                      EC-Council CEH Practice Tests

                      CEH v13 Domain 2.1 Practice Test 002

                      April 16, 2026 The Test Master
                      EC-Council CEH Practice Tests

                      CEH v13 Domain 1.1 Practice Test 002

                      April 16, 2026 The Test Master
                      EC-Council CEH Practice Tests

                      CEH v13 Domain 9.1 Practice Test 001

                      April 16, 2026 The Test Master