312-50 Question 58
Single answer▪ Network Scanning ConceptsDuring an authorized internal assessment, you need to identify live hosts on a subnet (10.10.20.0/24) before performing more detailed service enumeration. The environment includes Windows and Linux systems, and you have been told that many hosts block ICMP echo requests at the host firewall. You want a discovery method that still identifies active systems reliably without performing a full TCP connect scan. Which Nmap command is the most appropriate choice?
- A
nmap -sn 10.10.20.0/24
- B
nmap -sT 10.10.20.0/24
- C
nmap -Pn 10.10.20.0/24
- D
nmap -sU 10.10.20.0/24
Show answer and explanation
Correct answer: A
Explanation
For network scanning concepts in CEH, candidates should distinguish host discovery from port scanning. In this scenario, the requirement is to find live hosts first, not enumerate services. Nmap's -sn option is designed for this purpose. On local networks, ARP discovery is particularly effective because ARP is required for IPv4 address resolution on Ethernet and is not affected by host-based blocking of ICMP echo requests in the same way that ping is. By contrast, -sT and -sU are port-scanning techniques, and -Pn disables discovery entirely, which is useful in some cases but not ideal for efficiently identifying active hosts across a subnet. This aligns with Nmap best practices described in the Nmap Reference Guide, especially the sections on host discovery and scan techniques.
- A. Correct.
Correct. The -sn option performs host discovery without a port scan. On a local Ethernet network, Nmap can use ARP discovery, which is highly effective even when hosts block ICMP echo requests. In routed environments, Nmap host discovery may also use multiple probe types depending on privileges and configuration. This makes -sn the most appropriate initial step when the goal is to identify live hosts while minimizing unnecessary port-scanning activity.
- B. Incorrect.
Incorrect. The -sT option performs a TCP connect scan, which is a full port scan using the operating system's connect() call. While it may reveal live hosts indirectly, it is not a host discovery-focused method and generates more connection activity than necessary for the stated objective.
- C. Incorrect.
Incorrect. The -Pn option tells Nmap to skip host discovery and treat all targets as online. This is useful when discovery probes are blocked, but it is inefficient for identifying which hosts are actually alive on an entire subnet because Nmap will proceed to scan every address as if it is up.
- D. Incorrect.
Incorrect. The -sU option performs a UDP port scan, not host discovery. UDP scanning is typically slower and less reliable for simply determining whether hosts are live, especially compared with dedicated discovery techniques such as ARP-based or probe-based host discovery.