nerdexam
EC-Council

312-50V12 · Question #221

An ethical hacker is hired to conduct a comprehensive network scan of a large organization that strongly suspects potential intrusions into their internal systems. The hacker decides to employ a combi

The correct answer is A. Use Hping3 for an ICMP ping scan on the entire subnet, then use Nmap for a SYN scan on. To gain comprehensive network information, an ethical hacker should methodically discover live hosts first and then perform detailed port scans on those identified targets.

Submitted by asante_acc· Mar 4, 2026Reconnaissance Techniques

Question

An ethical hacker is hired to conduct a comprehensive network scan of a large organization that strongly suspects potential intrusions into their internal systems. The hacker decides to employ a combination of scanning tools to obtain a detailed understanding of the network. Which sequence of actions would provide the most comprehensive information about the network's status?

Options

  • AUse Hping3 for an ICMP ping scan on the entire subnet, then use Nmap for a SYN scan on
  • BStart with Hping3 for a UDP scan on random ports, then use Nmap for a version detection scan,
  • CBegin with NetScanTools Pro for a general network scan, then use Nmap for OS detection and
  • DInitiate with Nmap for a ping sweep, then use Metasploit to scan for open ports and services, and

How the community answered

(21 responses)
  • A
    86% (18)
  • B
    5% (1)
  • C
    10% (2)

Why each option

To gain comprehensive network information, an ethical hacker should methodically discover live hosts first and then perform detailed port scans on those identified targets.

AUse Hping3 for an ICMP ping scan on the entire subnet, then use Nmap for a SYN scan onCorrect

Hping3's ICMP ping scan efficiently identifies live hosts across a subnet, establishing a target list for subsequent detailed analysis. Nmap's SYN scan (`-sS`) then stealthily and effectively discovers open TCP ports on those specific hosts, providing critical service-level information without completing a full handshake, which is essential for comprehensive network mapping.

BStart with Hping3 for a UDP scan on random ports, then use Nmap for a version detection scan,

Starting with a UDP scan on random ports is inefficient and less reliable for initial host discovery compared to ICMP, and performing version detection before thorough port discovery is suboptimal.

CBegin with NetScanTools Pro for a general network scan, then use Nmap for OS detection and

A general network scan followed immediately by OS detection lacks the precise, foundational steps of systematic host and port discovery for comprehensive information gathering.

DInitiate with Nmap for a ping sweep, then use Metasploit to scan for open ports and services, and

While Nmap can perform ping sweeps, using Metasploit primarily for initial port and service scanning is not optimal, as Nmap is a more specialized and comprehensive tool for this reconnaissance phase.

Concept tested: Network reconnaissance, host discovery, port scanning techniques, tool sequencing

Source: https://nmap.org/book/man-port-scanning-techniques.html

Topics

#Network scanning#Nmap#Hping3#Ping sweep#SYN scan

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V12 Practice