A penetration tester needs to scan a remote infrastructure with Nmap. The tester issues the following command: nmap 10.10.1.0/24 Which of the following is the number of TCP ports that will be scanned?

The correct answer is B. 1,000. Explanation When Nmap is run without specifying a port range, it defaults to scanning the top 1,000 most commonly used TCP ports (not all ports, and not a sequential range), making B (1,000) correct. Option A (256) is incorrect as it has no relevance to Nmap's default behavior…

Submitted by akirajp· Mar 6, 2026Reconnaissance and Enumeration

Question

A penetration tester needs to scan a remote infrastructure with Nmap. The tester issues the following command:

nmap 10.10.1.0/24 Which of the following is the number of TCP ports that will be scanned?

Options

A256
B1,000
C1,024
D65,535

How the community answered

(29 responses)

B
90% (26)
C
3% (1)
D
7% (2)

Explanation

When Nmap is run without specifying a port range, it defaults to scanning the top 1,000 most commonly used TCP ports (not all ports, and not a sequential range), making B (1,000) correct. Option A (256) is incorrect as it has no relevance to Nmap's default behavior and may be confused with the number of hosts in a /24 subnet. Option C (1,024) is a common distractor because many people associate well-known ports with the range 0–1,023, but Nmap does not use this as its default scan range. Option D (65,535) represents the total number of available TCP ports, which would only be scanned if you explicitly used the flag -p- or -p 1-65535.

Memory Tip: Think of Nmap's default as scanning the "Top 1,000 Greatest Hits" of ports - it focuses on the most popular ports for efficiency. If you want all ports, you must ask for them explicitly with -p-. The /24 subnet notation (256 hosts) is a red herring - it describes hosts, not ports.

Topics

#Nmap#Port scanning#Default behavior#Network reconnaissance

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice