Overview
Domain 2 covers gathering and mapping target information across three modules. Footprinting and reconnaissance covers passive and active information gathering through OSINT, DNS, WHOIS, search engines, social media and website analysis. Scanning networks covers discovering live hosts, open ports and services, and the specific Nmap scan types and flags the exam tests closely. Enumeration covers extracting detailed information from services such as SNMP, LDAP, NTP, NFS, SMTP, DNS and SMB, revealing usernames, shares, network resources and configuration.
This domain is the second phase of the methodology and the foundation for everything after it. A thorough map here decides which vulnerabilities are analyzed in Domain 3 and which attacks succeed in Domains 4 and 5. The exam tests this domain in fine detail, especially Nmap flags and enumeration protocols, which are two of the most common places candidates lose points.
How it's tested
Expect detailed questions showing Nmap commands or output, OSINT scenarios, or enumeration situations, asking what a flag does, which tool or protocol fits, or what information a technique reveals. The questions reward exact knowledge of flags, ports and protocols. Read the full scenario and every option carefully before deciding.
-
Nmap flag behavior
A scan flag or command is shown, and you must identify the scan type or what it does at the packet level.
-
Enumeration protocol
A need to extract specific information is described, and you must choose the protocol or tool, such as SNMP, LDAP or SMB enumeration.
-
Footprinting source
An information-gathering goal is described, and you must choose the passive or active technique or OSINT source.
A tester wants to map open ports on a host while minimizing the chance of being logged by the target application. A full TCP connect scan completes the handshake and is easily logged. A SYN scan sends SYN packets and never completes the connection, so it is stealthier and faster. The flag for that half-open scan is -sS, which is the answer the exam expects.
Domains 3
Official domains from the EC-Council outline, in outline order.
2.1 Footprinting and ReconnaissancePassive and active information gathering through OSINT, DNS, WHOIS and more.
- What it means
- Footprinting collects information about a target using OSINT (social media, job boards, websites), DNS and reverse DNS lookups, WHOIS, search engine and advanced operator queries, email and website footprinting, and competitive intelligence, building a profile before any intrusive activity.
- What to understand
- Footprinting is mostly passive and precedes scanning. It reveals domains, IP ranges, technologies, employees and email formats that feed later phases. Public sources such as certificate transparency logs and DNS records expose infrastructure without touching the target.
- How it shows up
- An information-gathering goal is described, and you must choose the technique or source, or identify whether it is passive or active.
- Common confusion
- Confusing footprinting with scanning. Footprinting gathers information largely without direct interaction; scanning actively probes.
2.2 Scanning NetworksHost discovery, port and service scanning, and Nmap scan types.
- What it means
- Scanning discovers live hosts, open ports and running services, and determines OS and service versions. It covers scan types and the Nmap flags that implement them, such as TCP connect (-sT), SYN (-sS), UDP (-sU), ACK (-sA) and the FIN, Xmas and Null scans, plus version detection (-sV), OS detection (-O) and host discovery options.
- What to understand
- Each scan type behaves differently at the packet level, which affects stealth and what it reveals. A SYN scan never completes the handshake, making it stealthier than a connect scan. ACK scans map firewall rules rather than open ports. Knowing the flag-to-behavior mapping is essential.
- How it shows up
- A scan flag, command or stealth requirement is described, and you must identify the scan type or its packet behavior.
- Common confusion
- Mixing up -sS (SYN) and -sT (connect). SYN is half-open and stealthier; connect completes the handshake and is easily logged.
2.3 EnumerationExtracting usernames, shares and configuration from services such as SNMP, LDAP, NFS and SMB.
- What it means
- Enumeration extracts detailed information from identified services: NetBIOS and SMB for shares and users, SNMP for device and network details, LDAP for directory information, NTP for time and host data, SMTP for valid email accounts, DNS for records and possible zone transfers, and others such as NFS, RPC and SMTP.
- What to understand
- Enumeration turns a list of open services into specific, usable detail such as valid usernames, shares and network layout. Each protocol exposes different information, so you must match the protocol to the target data. Default community strings in SNMP and anonymous access in SMB or LDAP are classic enumeration openings.
- How it shows up
- A service or target detail is described, and you must choose the enumeration protocol or tool that extracts it.
- Common confusion
- Confusing which protocol reveals what. SNMP exposes device and network data, while LDAP exposes directory and user information.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Passive vs. active reconnaissance
Passive gathers information without contacting the target; active probes it.
- Remember
- Footprinting is largely passive; scanning is active.
- Tested as
- Classification questions.
- Trap
- Calling scanning passive.
-
SYN scan (-sS)
A half-open scan that sends SYN packets without completing the handshake.
- Remember
- Stealthier and faster than a connect scan.
- Tested as
- Nmap flag questions.
- Trap
- Confusing it with the connect scan.
-
TCP connect scan (-sT)
Completes the full three-way handshake.
- Remember
- Reliable but easily logged by the target.
- Tested as
- Nmap flag questions.
- Trap
- Thinking it is stealthy.
-
UDP scan (-sU)
Scans UDP ports, which are slower and often filtered.
- Remember
- Needed for services such as SNMP and DNS.
- Tested as
- Nmap flag questions.
- Trap
- Forgetting UDP services entirely.
-
ACK scan (-sA)
Maps firewall rule sets rather than open ports.
- Remember
- It identifies filtered versus unfiltered ports.
- Tested as
- Firewall mapping questions.
- Trap
- Expecting it to list open ports.
-
FIN, Xmas and Null scans
Stealth scans that set unusual flag combinations to evade simple filters.
- Remember
- They exploit how systems respond to unexpected flags.
- Tested as
- Stealth scan questions.
- Trap
- Confusing their flag combinations.
-
Version and OS detection (-sV, -O)
Identify service versions and the operating system.
- Remember
- They guide exploit selection later.
- Tested as
- Scanning questions.
- Trap
- Confusing version detection with OS detection.
-
SNMP enumeration
Extracts device and network information, often via default community strings.
- Remember
- Default public and private strings are common openings.
- Tested as
- Enumeration questions.
- Trap
- Overlooking SNMP on UDP 161.
-
LDAP enumeration
Extracts directory information such as users and groups.
- Remember
- Anonymous binds can expose directory data.
- Tested as
- Enumeration questions.
- Trap
- Confusing LDAP data with SNMP data.
-
SMB and NetBIOS enumeration
Reveals shares, users and sessions on Windows networks.
- Remember
- Null sessions and anonymous access are classic openings.
- Tested as
- Enumeration questions.
- Trap
- Forgetting the relevant ports (137–139, 445).
-
DNS zone transfer
Requesting a full copy of a DNS zone from a misconfigured server.
- Remember
- It can reveal the entire internal host list.
- Tested as
- Enumeration questions.
- Trap
- Treating normal DNS lookups as zone transfers.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
SYN vs. connect vs. UDP vs. ACK scan
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| SYN (-sS) | Half-open scan, no completed handshake | Stealthy and fast | Confusing it with connect |
| Connect (-sT) | Completes the full handshake | Reliable but easily logged | Assuming it is stealthy |
| UDP (-sU) | Scans UDP ports | Slow, finds UDP services | Skipping UDP services |
| ACK (-sA) | Maps firewall filtering | Shows filtered vs. unfiltered, not open ports | Expecting an open-port list |
Footprinting vs. scanning vs. enumeration
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Footprinting | Gather information, largely passively | Little or no direct interaction | Treating it as scanning |
| Scanning | Probe hosts, ports and services | Active discovery | Calling it enumeration |
| Enumeration | Extract detailed data from services | Deep, service-specific detail | Confusing which protocol reveals what |
SNMP vs. LDAP vs. SMB enumeration
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| SNMP | Device and network management data | Uses community strings on UDP 161 | Confusing its data with LDAP's |
| LDAP | Directory information such as users and groups | Anonymous binds expose directory data | Expecting device details |
| SMB/NetBIOS | Shares, users and sessions on Windows | Null sessions reveal data | Forgetting the ports involved |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Connect for stealth
- What candidates pick
- Use a TCP connect scan (-sT) to avoid detection.
- Why it looks right
- It reliably confirms open ports.
- Why it's wrong
- A connect scan completes the handshake and is easily logged. A SYN scan (-sS) is the stealthier half-open option.
Clue to watch for The requirement is stealth or avoiding logs.
-
ACK finds open ports
- What candidates pick
- Use an ACK scan to list open ports.
- Why it looks right
- It is a scan type.
- Why it's wrong
- An ACK scan maps firewall filtering, distinguishing filtered from unfiltered ports, not open ones.
Clue to watch for The goal is firewall rule mapping.
-
Skip UDP
- What candidates pick
- Rely only on TCP scans to find all services.
- Why it looks right
- TCP scanning is faster and more familiar.
- Why it's wrong
- Key services such as SNMP, DNS and DHCP run on UDP and would be missed.
Clue to watch for The target runs UDP-based services.
-
SNMP equals LDAP
- What candidates pick
- Use LDAP enumeration to retrieve device and network statistics.
- Why it looks right
- Both are enumeration protocols.
- Why it's wrong
- SNMP exposes device and network data; LDAP exposes directory information such as users and groups.
Clue to watch for The target data is device or network details versus directory entries.
-
Lookup is a zone transfer
- What candidates pick
- Call a standard DNS query a zone transfer.
- Why it looks right
- Both involve DNS.
- Why it's wrong
- A zone transfer requests the full zone from a misconfigured server, revealing all records, unlike a single lookup.
Clue to watch for The scenario mentions retrieving all DNS records at once.
-
Footprinting touches the target
- What candidates pick
- Classify active probing as footprinting.
- Why it looks right
- Both gather information.
- Why it's wrong
- Footprinting is largely passive. Direct probing is scanning, a later phase.
Clue to watch for The activity sends packets to the target.
Answer framework
For any Domain 2 reconnaissance scenario, use these steps before choosing an answer.
- Identify which of the three modules applies: footprinting, scanning or enumeration, since each uses different techniques.
- For footprinting, judge whether the method is passive or active, and pick the OSINT source or query that fits the goal.
- For scanning, match the Nmap flag to its packet-level behavior, weighing stealth, speed and whether open ports or firewall rules are the target.
- Include UDP where relevant, since services such as SNMP, DNS and DHCP would otherwise be missed.
- For enumeration, match the protocol to the data sought, such as SNMP for device details, LDAP for directory data and SMB for shares, and confirm whether the technique is passive or active before acting.
Practice question
Want more like this? The CEH practice test has questions for every domain.
Checklist
0 of 11
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
This is a detail-heavy domain, so study for precise recall. Start with Nmap, because the exam tests flags at the packet level. Build a table of scan types with the flag, the packet behavior, the stealth level and what each reveals, then drill it until you can answer instantly. Pay special attention to the -sS versus -sT distinction and to the ACK scan's firewall-mapping role.
Next, master enumeration. Make a second table of protocols (SNMP, LDAP, NTP, NFS, SMTP, DNS, SMB) against the information each exposes and the common openings, such as default community strings and null sessions. The exam rewards knowing which protocol reveals which data.
Footprinting is the easiest of the three modules, so learn the OSINT sources and the passive-versus-active distinction and move on. A lab with Nmap against a safe target makes the flag behaviors stick far better than reading. Afterwards, move to Domain 3, where the services and versions you enumerate here are analyzed for vulnerabilities.
FAQ
How much of CEH v13 is Domain 2?
Reconnaissance Techniques is about 17% of the exam, roughly 21 questions across footprinting, scanning and enumeration.
What is the difference between a SYN and a connect scan?
A SYN scan (-sS) sends SYN packets without completing the handshake, so it is stealthier and faster. A TCP connect scan (-sT) completes the full handshake and is easily logged.
Why does the exam test Nmap flags so closely?
Because the flag determines the packet-level behavior, stealth and results. The exam wants you to know what each scan does, not just that it scans.
What does an ACK scan reveal?
It maps firewall filtering, distinguishing filtered from unfiltered ports, rather than listing open ports.
Which protocol should I use to enumerate device information?
SNMP, which exposes device and network management data, often through default community strings on UDP 161.
What is a DNS zone transfer?
A request for a full copy of a DNS zone from a misconfigured server, which can reveal the entire internal host list.
How does Domain 2 connect to the rest of the exam?
It builds the target map that determines which vulnerabilities are analyzed in Domain 3 and which attacks succeed in Domains 4 and 5.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 2 knowledge
You have covered footprinting, scanning and enumeration, including Nmap scan types and the enumeration protocols. Test whether you can recall flags and protocols precisely under exam conditions.