nerdexam
CompTIA

PT0-002 · Question #488

A penetration tester is scanning a customer subnet and wants to scan ports that are known to have only well-known UDP services present. Which of the following can the tester use to scan for SNMP…

The correct answer is A. nmap -vv -sUV -p 53,123,137-139,161 192.168.1.0/24 -oA udpscan. To scan for well-known UDP services like DNS, NTP, NetBIOS, and SNMP across a subnet, the penetration tester should use Nmap's UDP scan type with specified ports.

Information Gathering and Vulnerability Scanning

Question

A penetration tester is scanning a customer subnet and wants to scan ports that are known to have only well-known UDP services present. Which of the following can the tester use to scan for SNMP. NTP, NetBIOS, and DNS?

Options

  • Anmap -vv -sUV -p 53,123,137-139,161 192.168.1.0/24 -oA udpscan
  • Bnmap -vv -sXV -p 53-123,137,139,161 192.168.1.0/24 -oA udpscan
  • Cnmap -vv -sTV -p 53, 123, 137-139,161,123 192.168.1.0/24 -oA udpscan
  • Dnmap -vv -sUV -p 53-161,192.168.1.0 -oA udpscan

How the community answered

(37 responses)
  • A
    78% (29)
  • B
    14% (5)
  • C
    3% (1)
  • D
    5% (2)

Why each option

To scan for well-known UDP services like DNS, NTP, NetBIOS, and SNMP across a subnet, the penetration tester should use Nmap's UDP scan type with specified ports.

Anmap -vv -sUV -p 53,123,137-139,161 192.168.1.0/24 -oA udpscanCorrect

Option A correctly uses `nmap -sUV` (interpreted as UDP scan with version detection) and specifies the correct UDP ports for DNS (53), NTP (123), NetBIOS (137-139, covering 137 and 138 UDP), and SNMP (161). The target `192.168.1.0/24` correctly defines the subnet for scanning, making this the most appropriate command.

Bnmap -vv -sXV -p 53-123,137,139,161 192.168.1.0/24 -oA udpscan

Option B uses `-sXV`, which is for a TCP Xmas scan, not suitable for scanning UDP services. The port range `53-123` is also too broad and misses critical ports like 138 and 161.

Cnmap -vv -sTV -p 53, 123, 137-139,161,123 192.168.1.0/24 -oA udpscan

Option C uses `-sTV`, which performs a TCP connect scan, rendering it incorrect for scanning UDP services. The port list also contains a duplicate '123'.

Dnmap -vv -sUV -p 53-161,192.168.1.0 -oA udpscan

Option D specifies a broad port range `53-161` which is less targeted, and the target syntax `192.168.1.0` without a CIDR is incorrect for scanning a subnet, likely interpreted as part of the port list.

Concept tested: Nmap UDP scanning and service port identification

Source: https://nmap.org/book/man-port-scanning-basics.html#man-udp-scan

Topics

#nmap#UDP scan#Port scanning#Well-known ports

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PT0-002 Practice