312-50V9 · Question #118
A security engineer is attempting to map a company's internal network. The engineer enters in the following NMAP command: NMAP -n -sS -P0 -p 80 ... What type of scan is this?
The correct answer is C. Stealth scan. The -sS Nmap flag performs a TCP SYN (half-open) scan, widely called a stealth scan because it never completes the three-way handshake and therefore avoids full connection logging on many systems.
Question
A security engineer is attempting to map a company's internal network. The engineer enters in the following NMAP command:
NMAP -n -sS -P0 -p 80 ... What type of scan is this?
Options
- AQuick scan
- BIntense scan
- CStealth scan
- DComprehensive scan
How the community answered
(27 responses)- B7% (2)
- C89% (24)
- D4% (1)
Why each option
The -sS Nmap flag performs a TCP SYN (half-open) scan, widely called a stealth scan because it never completes the three-way handshake and therefore avoids full connection logging on many systems.
A quick scan in Nmap terminology uses default port lists and timing and is not specifically identified by the -sS flag or the minimal-port configuration shown here.
An intense scan in Nmap typically combines -T4, -A (OS and version detection), and broader port ranges - none of which are present in this command.
The -sS flag sends a SYN packet and, upon receiving a SYN-ACK, responds with a RST rather than completing the TCP handshake, so the connection is never fully established and many application-layer logs do not record it. The supporting flags -n (no DNS resolution), -P0 (skip host discovery ping), and -p 80 (single port) further reduce the scan's network footprint and visibility to defenders.
A comprehensive scan would include version detection (-sV), OS detection (-O), and script scanning (-sC or -A), which are all absent from this command.
Concept tested: Nmap TCP SYN stealth scan (-sS flag)
Source: https://nmap.org/book/synscan.html
Topics
Community Discussion
No community discussion yet for this question.