nerdexam
EC-Council

312-50V11 · Question #627

Study the log below and identify the scan type.

The correct answer is D. nmap -sO -T 192.168.1.10. The nmap -sO flag performs an IP protocol scan, which probes which IP-layer protocols (ICMP, TCP, UDP, IGMP, etc.) are supported rather than scanning TCP or UDP ports.

Scanning Networks

Question

Study the log below and identify the scan type.

Exhibit

312-50V11 question #627 exhibit

Options

  • Anmap -sR 192.168.1.10
  • Bnmap -sS 192.168.1.10
  • Cnmap -sV 192.168.1.10
  • Dnmap -sO -T 192.168.1.10

How the community answered

(43 responses)
  • A
    5% (2)
  • B
    23% (10)
  • C
    12% (5)
  • D
    60% (26)

Why each option

The nmap -sO flag performs an IP protocol scan, which probes which IP-layer protocols (ICMP, TCP, UDP, IGMP, etc.) are supported rather than scanning TCP or UDP ports.

Anmap -sR 192.168.1.10

The -sR flag performs an RPC scan to identify RPC-based services on open ports, which would show RPC program data rather than IP protocol numbers.

Bnmap -sS 192.168.1.10

The -sS flag performs a TCP SYN (half-open) scan, which would log TCP port states (open, closed, filtered) rather than IP protocol responses.

Cnmap -sV 192.168.1.10

The -sV flag performs service and version detection against open ports, which would log service names and version strings rather than raw protocol numbers.

Dnmap -sO -T 192.168.1.10Correct

The -sO switch instructs nmap to iterate through IP protocol numbers (0-255) and send raw IP packets to determine which protocols the target host responds to, producing output listing protocol numbers rather than port numbers. The -T flag sets the timing template, controlling scan aggressiveness and packet rate. This scan type produces a log showing protocol IDs rather than port states, which is the distinguishing characteristic of the observed log.

Concept tested: Nmap IP protocol scan (-sO) log identification

Source: https://nmap.org/book/scan-methods-ip-protocol-scan.html

Topics

#nmap#IP protocol scan#scan type identification#log analysis

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice