nerdexam
GIAC

GCIH · Question #85

Which of the following services CANNOT be performed by the nmap utility? Each correct answer represents a complete solution. Choose all that apply.

The correct answer is A. Passive OS fingerprinting B. Sniffing. Nmap is an active scanning tool capable of port scanning and active OS fingerprinting, but it cannot perform passive OS fingerprinting or packet sniffing - those require dedicated tools.

Reconnaissance, Scanning, and Enumeration

Question

Which of the following services CANNOT be performed by the nmap utility? Each correct answer represents a complete solution. Choose all that apply.

Options

  • APassive OS fingerprinting
  • BSniffing
  • CActive OS fingerprinting
  • DPort scanning

How the community answered

(48 responses)
  • A
    90% (43)
  • C
    4% (2)
  • D
    6% (3)

Why each option

Nmap is an active scanning tool capable of port scanning and active OS fingerprinting, but it cannot perform passive OS fingerprinting or packet sniffing - those require dedicated tools.

APassive OS fingerprintingCorrect

Passive OS fingerprinting works by silently observing existing network traffic without sending any packets; nmap only performs active probing and has no passive traffic analysis capability - tools like p0f are used for this instead.

BSniffingCorrect

Sniffing requires capturing raw packets off the wire in a passive or promiscuous mode; nmap does not have a packet capture engine and this function belongs to dedicated tools like Wireshark or tcpdump.

CActive OS fingerprinting

Nmap directly supports active OS fingerprinting via the -O flag, which sends specially crafted packets and analyzes the TCP/IP stack responses to identify the remote OS.

DPort scanning

Port scanning is nmap's core and most widely used function, performed via TCP SYN, TCP connect, UDP, and other scan techniques.

Concept tested: Nmap capabilities vs passive sniffing tools

Source: https://nmap.org/book/man.html

Topics

#nmap#port scanning#OS fingerprinting#tool capabilities

Community Discussion

No community discussion yet for this question.

Full GCIH Practice