An ethical hacker is hired to conduct a comprehensive network scan of a large organization that strongly suspects potential intrusions into their internal systems. The hacker decides to employ a…

Question

Options

• AInitiate with Nmap for a ping sweep, then use Metasploit to scan for open ports and services, and
• BUse Hping3 for an ICMP ping scan on the entire subnet, then use Nmap for a SYN scan on
• CStart with Hping3 for a UDP scan on random ports, then use Nmap for a version detection scan,
• DBegin with NetScanTools Pro for a general network scan, then use Nmap for OS detection and

• A
  4% (1)
• B
  79% (19)
• C
  4% (1)
• D
  13% (3)

Explanation

Explanation

Option B is correct because it represents the most logical and methodical reconnaissance workflow: Hping3's ICMP ping sweep efficiently identifies live hosts across the subnet first, then Nmap's SYN scan (a stealthy, reliable half-open scan) precisely identifies open ports and services on discovered hosts - this two-phase approach maximizes coverage while minimizing unnecessary noise. Option A is flawed because Metasploit is primarily an exploitation framework, not a scanning tool, making it an inefficient choice for port/service discovery in this context. Option C starts with UDP scanning on random ports, which is inefficient and incomplete since UDP scanning is slow and randomly selecting ports misses systematic coverage. Option D's approach with NetScanTools Pro as the initial scanner is redundant when Nmap can handle both general scanning and OS detection itself, making the workflow unnecessarily complicated without added value.

Memory Tip: Think of ethical scanning as a funnel - always go broad to narrow: first find who's alive (ICMP/ping sweep), then find what's open (SYN scan). Remember "H before N" - Hping3 discovers hosts, then Nmap digs deeper. If a tool is primarily known for exploitation (like Metasploit), it doesn't belong in the scanning phase.

No community discussion yet for this question.