312-50 Question 61
Single answer▪ Scanning ToolsDuring an authorized internal assessment, you need to identify live hosts on a subnet where many Windows systems block ICMP echo requests at the host firewall. You still want a quick discovery method that is more reliable than a simple ping sweep and does not require a full port scan of every TCP port. Which Nmap approach is the most appropriate for this situation?
- A
Use Nmap host discovery with a TCP SYN ping to common ports, such as nmap -sn -PS80,443 10.10.20.0/24
- B
Use Nmap with a NULL scan, such as nmap -sN 10.10.20.0/24, because NULL scans are designed for host discovery when ICMP is filtered
- C
Use Nmap with an idle scan, such as nmap -sI zombie_host 10.10.20.0/24, because idle scans are the preferred way to discover live hosts behind Windows firewalls
- D
Use Nmap with version detection only, such as nmap -sV 10.10.20.0/24, because service fingerprinting automatically identifies which hosts are alive
Show answer and explanation
Correct answer: A
Explanation
The best answer is the TCP SYN ping host discovery approach using Nmap's -sn with -PS. In real assessments, relying only on ICMP echo requests can miss live hosts because many operating systems and host-based firewalls drop ping requests. Nmap's host discovery options are specifically intended to solve this problem by using alternative probes, including ICMP, TCP SYN, TCP ACK, and UDP-based discovery. For Windows-heavy environments, TCP-based host discovery to common ports is often more effective than ICMP alone. This aligns with Nmap's documented host discovery features and common assessment practice: first identify live hosts efficiently, then perform targeted port and service enumeration only where needed. Options like NULL scan, idle scan, and version detection are valid Nmap features, but they address different phases or goals of scanning and are not the most appropriate solution for efficient host discovery in this scenario.
- A. Correct.
Correct. Nmap host discovery supports TCP-based probes such as SYN ping (-PS) and ACK ping (-PA) to determine whether hosts are up without relying solely on ICMP echo replies. In environments where Windows hosts or perimeter devices block ICMP echo, sending SYN probes to common ports like 80 or 443 often produces a SYN/ACK or RST response from live systems, allowing reliable host discovery with less overhead than a full port scan. Using -sn also tells Nmap to perform host discovery without port scanning.
- B. Incorrect.
Incorrect. A NULL scan (-sN) is a TCP port scanning technique used to infer port states based on how a target responds to packets with no TCP flags set. It is not a host discovery method and is not designed to replace ping sweeps. In addition, NULL scans are generally ineffective against many Windows systems because Microsoft TCP/IP stacks typically do not implement RFC behavior in a way that makes NULL scans useful for distinguishing open and closed ports.
- C. Incorrect.
Incorrect. An idle scan (-sI) is a specialized stealth port scanning technique that uses a so-called zombie host to scan a target indirectly. It is not a preferred or practical choice for basic host discovery across a subnet, and it requires a suitable idle zombie host with predictable IP ID behavior. It is far more complex than necessary for simply identifying live hosts.
- D. Incorrect.
Incorrect. Version detection (-sV) attempts to identify services running on open ports after port scanning has already identified candidate ports. It is not a host discovery mechanism and generally creates more traffic than necessary for the stated goal. Using -sV alone does not make it the right tool for quickly finding live hosts when ICMP is blocked.