CEHCEH — Certified Ethical Hacker (CEH) v12

The correct answer is C) It appends the specified file extensions to each word in the wordlist during brute-force attempts. In Gobuster's directory brute-force mode, the -x flag specifies file extensions that should be appended to each word in the wordlist during scanning. When the tester provides -x php,bak,old, Gobuster takes each entry from the common.txt wordlist and tests it both as a directory name and with each specified extension appended. Network scanning is a critical phase where the attacker identifies live hosts, open ports, services, and vulnerabilities. Nmap is the primary tool tested, with scan types including SYN scan (-sS), TCP connect (-sT), XMAS scan (-sX), FIN scan (-sF), and NULL scan (-sN). Understanding TCP three-way handshake mechanics, banner grabbing with Netcat, OS fingerprinting (-O), and the distinction between vulnerability scanning (Nessus, OpenVAS) and port scanning is essential. IP scanning with ping sweeps (fping, hping3) and evasion techniques like fragmentation and decoys are also heavily tested. At difficulty level 5, this question requires applied understanding of tools and techniques.