nerdexam
CompTIA

PT0-002 · Question #370

A penetration tester conducted a discovery scan that generated the following: Which of the following commands generated the results above and will transform them into a list of active hosts for…

The correct answer is B. nmap -sn 192.168.0.1-254 | grep "Nmap scan" | awk '{print $5}'. The 'nmap -sn' command performs a ping scan to discover active hosts without port scanning, and piping its output through 'grep "Nmap scan"' then 'awk '{{print $5}}'' effectively filters and extracts only the IP addresses of discovered hosts. This sequence creates a concise…

Reconnaissance and enumeration

Question

A penetration tester conducted a discovery scan that generated the following:

Which of the following commands generated the results above and will transform them into a list of active hosts for further analysis?

Exhibit

PT0-002 question #370 exhibit

Options

  • Anmap -oG list.txt 192.168.0.1-254 | sort
  • Bnmap -sn 192.168.0.1-254 | grep "Nmap scan" | awk '{print $5}'
  • Cnmap --open 192.168.0.1-254 | uniq | sed 's/Nmap//2' > file.txt
  • Dnmap -O 192.168.0.1-254 | cut -f

How the community answered

(27 responses)
  • A
    11% (3)
  • B
    70% (19)
  • C
    15% (4)
  • D
    4% (1)

Why each option

The 'nmap -sn' command performs a ping scan to discover active hosts without port scanning, and piping its output through 'grep "Nmap scan"' then 'awk '{{print $5}}'' effectively filters and extracts only the IP addresses of discovered hosts. This sequence creates a concise list of active hosts, suitable for further targeted analysis.

Anmap -oG list.txt 192.168.0.1-254 | sort

'nmap -oG list.txt' saves output in Grepable format, but '| sort' without further parsing doesn't specifically extract only active hosts in a simple list format from the standard Nmap output for further analysis.

Bnmap -sn 192.168.0.1-254 | grep "Nmap scan" | awk '{print $5}'Correct

The 'nmap -sn' command performs a "ping scan" (host discovery) without port scanning, which is efficient for finding active hosts. Piping this output to 'grep "Nmap scan"' filters for lines indicating a host report, and 'awk '{{print $5}}'' then extracts the fifth field, which typically corresponds to the IP address of the active host.

Cnmap --open 192.168.0.1-254 | uniq | sed 's/Nmap//2' > file.txt

'nmap --open' scans for open ports, not just host discovery, and piping to 'uniq' and 'sed' without specific output format knowledge won't reliably produce a list of active hosts. 'sed 's/Nmap//2'' is unlikely to correctly parse IP addresses from a standard Nmap output.

Dnmap -O 192.168.0.1-254 | cut -f

'nmap -O' performs OS detection, which is resource-intensive and not primarily for generating a list of active hosts efficiently. '| cut -f' is incomplete and wouldn't correctly extract host IPs without specifying delimiters and field numbers.

Concept tested: Nmap host discovery and command line parsing

Source: https://nmap.org/book/man-host-discovery.html

Topics

#Nmap#Host Discovery#Command Line Tools#Reconnaissance

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice