nerdexam
EC-Council

312-50V10 · Question #343

A security engineer is attempting to map a company's internal network. The engineer enters in the following NMAP command: NMAP -n -sS -P0 -p 80 ... What type of scan is this?

The correct answer is C. Stealth scan. The NMAP -sS flag performs a TCP SYN scan, known as a stealth scan because it never completes the three-way handshake.

Scanning Networks

Question

A security engineer is attempting to map a company's internal network. The engineer enters in the following NMAP command:

NMAP -n -sS -P0 -p 80 ... What type of scan is this?

Options

  • AQuick scan
  • BIntense scan
  • CStealth scan
  • DComprehensive scan

How the community answered

(40 responses)
  • A
    3% (1)
  • B
    8% (3)
  • C
    88% (35)
  • D
    3% (1)

Why each option

The NMAP -sS flag performs a TCP SYN scan, known as a stealth scan because it never completes the three-way handshake.

AQuick scan

A quick scan uses the -F flag to scan a reduced set of ports, which is not present in this command.

BIntense scan

An intense scan uses -T4 -A to enable OS detection, version scanning, and script scanning, none of which are specified here.

CStealth scanCorrect

The -sS flag instructs NMAP to send a SYN packet and, upon receiving a SYN-ACK, respond with RST instead of completing the TCP handshake. This half-open technique avoids creating a full connection that would appear in application logs, making detection harder and earning it the name stealth scan.

DComprehensive scan

A comprehensive scan typically combines -sS -sU -T4 -A -v across a broad port range, far beyond the single-port scan shown here.

Concept tested: NMAP TCP SYN stealth scan technique

Source: https://nmap.org/book/man-port-scanning-techniques.html

Topics

#NMAP#SYN scan#stealth scan#port scanning

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice