nerdexam
EC-Council

312-50V9 · Question #311

An attacker is using nmap to do a ping sweep and a port scanning in a subnet of 254 addresses. In which order should he perform these steps?

The correct answer is C. First the ping sweep to identify live hosts and then the port scan on the live hosts. This way he. In network reconnaissance, performing a ping sweep before a port scan avoids wasting time scanning hosts that are offline, making the overall process more efficient.

Scanning Networks

Question

An attacker is using nmap to do a ping sweep and a port scanning in a subnet of 254 addresses. In which order should he perform these steps?

Options

  • AThe sequence does not matter. Both steps have to be performed against all hosts.
  • BFirst the port scan to identify interesting services and then the ping sweep to find hosts
  • CFirst the ping sweep to identify live hosts and then the port scan on the live hosts. This way he
  • DThe port scan alone is adequate. This way he saves time.

How the community answered

(28 responses)
  • A
    4% (1)
  • C
    93% (26)
  • D
    4% (1)

Why each option

In network reconnaissance, performing a ping sweep before a port scan avoids wasting time scanning hosts that are offline, making the overall process more efficient.

AThe sequence does not matter. Both steps have to be performed against all hosts.

The sequence does matter because running a full port scan against all 254 addresses regardless of host availability wastes significant time and generates unnecessary noise.

BFirst the port scan to identify interesting services and then the ping sweep to find hosts

Performing the port scan before the ping sweep inverts the logical order and wastes effort scanning hosts that may not even be online.

CFirst the ping sweep to identify live hosts and then the port scan on the live hosts. This way heCorrect

A ping sweep first identifies which of the 254 hosts are actually alive and reachable, reducing the target set to only live systems. Port scanning is then run exclusively against those live hosts, avoiding the overhead of sending port scan packets to addresses with no responding host. This staged approach is the standard efficient recon methodology used with tools like nmap.

DThe port scan alone is adequate. This way he saves time.

Using only a port scan without a prior ping sweep means sending probe packets to all 254 addresses including dead ones, which is far less efficient than filtering live hosts first.

Concept tested: Network reconnaissance ordering - ping sweep vs port scan

Source: https://nmap.org/book/man-host-discovery.html

Topics

#ping sweep#port scanning#nmap#host discovery

Community Discussion

No community discussion yet for this question.

Full 312-50V9 Practice