nerdexam
EC-Council

312-50V13 · Question #215

Techno Security Inc. recently hired John as a penetration tester. He was tasked with identifying open ports in the target network and determining whether the ports are online and any firewall rule set

The correct answer is C. nmap -sn -PS < target IP address >. To perform a TCP SYN ping scan with Nmap to check host online status and firewall rules, the command nmap -sn -PS <target IP address> is used.

Submitted by satoshi_tk· Mar 6, 2026Scanning Networks

Question

Techno Security Inc. recently hired John as a penetration tester. He was tasked with identifying open ports in the target network and determining whether the ports are online and any firewall rule sets are encountered. John decided to perform a TCP SYN ping scan on the target network. Which of the following Nmap commands must John use to perform the TCP SYN ping scan?

Options

  • Anmap -sn -pp < target ip address >
  • Bnmap -sn -PO < target IP address >
  • Cnmap -sn -PS < target IP address >
  • Dnmap -sn -PA < target IP address >

How the community answered

(35 responses)
  • A
    3% (1)
  • B
    9% (3)
  • C
    71% (25)
  • D
    17% (6)

Why each option

To perform a TCP SYN ping scan with Nmap to check host online status and firewall rules, the command `nmap -sn -PS <target IP address>` is used.

Anmap -sn -pp < target ip address >

The `-pp` option is not a standard Nmap ping scan type for TCP SYN ping scans.

Bnmap -sn -PO < target IP address >

The `-PO` option performs an IP protocol ping, which sends IP packets with different protocol numbers, not a TCP SYN ping.

Cnmap -sn -PS < target IP address >Correct

The `nmap -sn -PS <target IP address>` command explicitly performs a TCP SYN ping scan, sending SYN packets to common ports. This method helps Nmap determine if hosts are online and can also provide insights into firewall rules by observing SYN/ACK responses or lack thereof, with `-sn` disabling full port scanning for just host discovery.

Dnmap -sn -PA < target IP address >

The `-PA` option performs a TCP ACK ping scan, which sends ACK packets, distinct from a TCP SYN ping scan.

Concept tested: Nmap host discovery techniques (TCP SYN ping scan)

Source: https://nmap.org/book/man-host-discovery.html

Topics

#Nmap#TCP SYN scan#ping scan#network reconnaissance

Community Discussion

No community discussion yet for this question.

Full 312-50V13 Practice