nerdexam
CompTIA

PT0-002 · Question #487

During a reconnaissance exercise, a penetration tester runs the following Nmap command: nmap -sT -sV -T2 -p 1-65535 domain.com After watching the scan run for more than two hours, the tester wants…

The correct answer is C. Change -sT to -sS. The best way to significantly speed up the Nmap scan is to change the -sT (TCP connect scan) to -sS (SYN scan). A SYN scan is faster because it performs a half-open connection, avoiding the full three-way handshake and therefore being less resource-intensive and quicker than a…

Information Gathering and Vulnerability Scanning

Question

During a reconnaissance exercise, a penetration tester runs the following Nmap command:

nmap -sT -sV -T2 -p 1-65535 domain.com After watching the scan run for more than two hours, the tester wants to optimize the full scan. Which of the following is the best way to speed up the scan?

Options

  • AScan fewer ports list.
  • BScan via UDP to improve speed.
  • CChange -sT to -sS.
  • DKeep the scan timing.

How the community answered

(31 responses)
  • A
    3% (1)
  • B
    6% (2)
  • C
    74% (23)
  • D
    16% (5)

Why each option

The best way to significantly speed up the Nmap scan is to change the `-sT` (TCP connect scan) to `-sS` (SYN scan). A SYN scan is faster because it performs a half-open connection, avoiding the full three-way handshake and therefore being less resource-intensive and quicker than a full TCP connect scan.

AScan fewer ports list.

While scanning fewer ports (`-p 1-65535` is a full port scan) would speed up the scan, it compromises the comprehensiveness of the reconnaissance by potentially missing open ports.

BScan via UDP to improve speed.

Scanning via UDP (`-sU`) is generally much slower than TCP scans because UDP is connectionless and requires longer timeouts to determine if a port is open or filtered, often yielding less definitive results for 'open' states.

CChange -sT to -sS.Correct

Changing `-sT` (TCP connect scan) to `-sS` (SYN scan, also known as stealth scan) will significantly speed up the Nmap scan. A SYN scan does not complete the full three-way TCP handshake for open ports, which makes it much faster and also stealthier than a full TCP connect scan that establishes a complete connection.

DKeep the scan timing.

Keeping the scan timing (`-T2` which is 'Polite', meaning very slow) would explicitly prevent speeding up the scan; the goal is to optimize and accelerate it.

Concept tested: Nmap scan types and timing optimization

Source: https://nmap.org/book/man-port-scanning-techniques.html

Topics

#Nmap#Port scanning#Scan optimization#TCP SYN scan

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PT0-002 Practice