Examius
🇺🇸 Certified Ethical Hacker (CEH) · flashcards
Certified Ethical Hacker (CEH) Scanning, Enumeration, and Vulnerability Analysis Flashcards
51 question-and-answer cards covering Scanning, Enumeration, and Vulnerability Analysis as it is examined in Certified Ethical Hacker (CEH). 24 of them are printed below, taken from across the deck — no signup, no paywall on the preview.
24 sample cards from the Scanning, Enumeration, and Vulnerability Analysis deck
Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.
What ports are associated with NetBIOS, and what does NetBIOS enumeration reveal?
NetBIOS uses UDP 137 (Name Service), UDP 138 (Datagram), and TCP 139 (Session Service). Enumeration reveals computer names, domain/workgroup, shares, logged-on users, and the NetBIOS name table.
What Windows command-line tool lists NetBIOS name table information of a remote machine?
nbtstat — e.g., 'nbtstat -A <IP>' returns the remote machine's NetBIOS name table; 'nbtstat -c' shows the local NetBIOS name cache.
On which port does SMB operate directly over TCP/IP (without NetBIOS)?
TCP port 445. SMB can run over NetBIOS (TCP 139) or directly over TCP 445.
What is a null session and why is it a security concern in SMB/NetBIOS enumeration?
A null session is an unauthenticated connection to the IPC$ share using a blank username and password. It can let attackers enumerate users, groups, shares, and policies without credentials.
What does SNMP enumeration extract, and what default community strings are exploited?
SNMP enumeration extracts device info, running processes, user accounts, routing tables, and ARP tables from the MIB. Default community strings 'public' (read-only) and 'private' (read-write) are commonly exploited.
What is the MIB in the context of SNMP?
The Management Information Base is a hierarchical, tree-structured database of object identifiers (OIDs) describing the managed device's data that SNMP can query.
Which UDP ports does SNMP use?
SNMP uses UDP port 161 for agent queries/responses and UDP port 162 for SNMP traps (notifications).
What port does LDAP use, and what does LDAP enumeration reveal?
LDAP uses TCP/UDP 389 (and 636 for LDAPS/SSL). Enumeration reveals valid usernames, departments, addresses, and the Active Directory/directory structure.
What port does NTP use, and what can NTP enumeration disclose?
NTP uses UDP port 123. Enumeration (via commands like ntpdc, ntptrace, ntpq) can disclose connected hosts, client IP addresses, internal host names, and OS information.
What port does NFS use, and what is the risk enumerated via showmount?
NFS commonly uses TCP/UDP 2049 (with portmapper on 111). 'showmount -e <host>' enumerates exported shares; misconfigured exports can expose sensitive directories to unauthorized mounting.
Which DNS feature does DNS enumeration abuse to dump all records, and via which port?
DNS zone transfer (AXFR) over TCP port 53. If a misconfigured DNS server allows it, an attacker can retrieve the entire zone file with all hostnames and IPs.
Which SMTP commands are used to enumerate valid email users on a mail server?
VRFY (verify a user), EXPN (expand a mailing list), and RCPT TO (recipient). Server responses reveal whether usernames/mailboxes exist. SMTP uses TCP port 25.
List three effective enumeration countermeasures.
Disable null sessions / restrict anonymous access (RestrictAnonymous), change or disable default SNMP community strings, disable unnecessary services and DNS zone transfers, and filter ports 139/445/161/389 at the firewall.
Define vulnerability assessment.
A vulnerability assessment is the systematic process of identifying, quantifying, classifying, and prioritizing security weaknesses (vulnerabilities) in systems, networks, and applications — without necessarily exploiting them.
How does a vulnerability assessment differ from a penetration test?
A vulnerability assessment identifies and reports weaknesses (broad, often automated, non-exploitative). A penetration test goes further by actively exploiting vulnerabilities to demonstrate real impact and is typically deeper but narrower.
Compare active vs passive vulnerability assessment.
Active assessment directly probes/interacts with hosts and network devices (sending packets) to find vulnerabilities. Passive assessment sniffs network traffic to infer vulnerabilities without directly touching targets.
What does CVSS stand for, and what is its numeric score range and severity bands?
Common Vulnerability Scoring System. Scores range 0.0–10.0: None (0.0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9), Critical (9.0–10.0).
What are the three metric groups in CVSS?
Base (intrinsic, constant characteristics), Temporal (change over time, e.g., exploit maturity/patch availability), and Environmental (specific to a user's environment/impact).
What is the CVE and who maintains it?
Common Vulnerabilities and Exposures — a dictionary of publicly known security flaws, each given a unique CVE ID (e.g., CVE-2021-44228). It is maintained by MITRE (sponsored by US-CERT/DHS).
What is the NVD and how does it relate to CVE?
The National Vulnerability Database (NVD), run by NIST, is the US government repository that enriches CVE entries with CVSS scores, severity ratings, CWE mappings, and references.
What is CWE and how does it differ from CVE?
CWE (Common Weakness Enumeration) is a categorized list of software/hardware weakness types (e.g., CWE-79 XSS). CVE identifies specific instances of vulnerabilities in particular products, whereas CWE classifies the underlying weakness category.
Name three popular vulnerability scanning tools.
Nessus (Tenable), Qualys, OpenVAS, Nexpose/InsightVM (Rapid7), GFI LanGuard, and Nikto (web). These automate detection and CVSS-based prioritization of vulnerabilities.
What key elements should a vulnerability assessment report contain?
Executive summary, scan scope/methodology, list of findings with severity (CVSS) and CVE references, affected assets, risk ratings, and prioritized remediation recommendations.
What are the four common remediation strategies for handling identified vulnerabilities?
Mitigate/remediate (patch or reconfigure to fix), Transfer (e.g., insurance/third party), Accept (acknowledge low risk), and Avoid (eliminate the asset/feature). Remediation is prioritized by risk/CVSS severity.
What this deck covers
The Scanning, Enumeration, and Vulnerability Analysis deck follows the Certified Ethical Hacker (CEH) Scanning, Enumeration, and Vulnerability Analysis syllabus — 3 chapters and 14 topics — so questions land on material that is genuinely examinable rather than trivia around it. That works out to roughly 17.0 cards per chapter.
Answers are written to be recallable, not just readable — averaging about 178 characters, which is long enough to carry the reasoning and short enough to say out loud.
A deck like this earns its keep on the second and third pass. Read the syllabus first so you know the shape of the subject, then use the cards to find the specific facts that have not stuck.
Scanning, Enumeration, and Vulnerability Analysis flashcards FAQ
How many Scanning, Enumeration, and Vulnerability Analysis flashcards are in this Certified Ethical Hacker (CEH) deck?
51 cards. This page previews 24 of them, sampled evenly across the deck so you can judge the difficulty before installing anything.
Are these Certified Ethical Hacker (CEH) flashcards free?
Yes. The preview here is free to read with no signup, and the full 51-card deck is free inside the Examius app.
What do the Scanning, Enumeration, and Vulnerability Analysis cards cover?
They follow the Certified Ethical Hacker (CEH) Scanning, Enumeration, and Vulnerability Analysis syllabus — 3 chapters and 14 topics — so the questions track what is actually examinable.
How should I use these flashcards?
Read the syllabus first so you know the shape of the subject, then drill the deck. Examius schedules each card with spaced repetition, so cards you keep missing come back sooner and ones you know drift further apart.