312-50 Question 62
Single answer▪ Scanning ToolsDuring an internal authorized assessment, you need to identify live hosts and determine which TCP services are exposed on a /24 subnet. The client warns that several systems are legacy devices that may crash if probed aggressively, and the IDS team asks you to minimize scan noise while still obtaining reliable results. Which scanning approach is the MOST appropriate?
- A
Use Nmap with a TCP SYN scan and conservative timing, such as
nmap -sS -T2 10.10.20.0/24 - B
Use Nmap with an aggressive scan, such as
nmap -A -T5 10.10.20.0/24, to finish quickly before the IDS correlates events - C
Use a UDP-only scan, such as
nmap -sU 10.10.20.0/24, because UDP scanning is inherently less likely to affect legacy devices - D
Use a full TCP connect scan with maximum parallelism, such as
nmap -sT --min-parallelism 100 10.10.20.0/24, because completed handshakes are more stealthy than half-open probes
Show answer and explanation
Correct answer: A
Explanation
The best choice is a TCP SYN scan with conservative timing because the scenario requires a practical balance between reliability and low impact. In Nmap, -sS is the standard half-open SYN scan for TCP port discovery when raw packet privileges are available, and lower timing templates such as -T2 reduce aggressiveness. By contrast, -A and -T5 increase intensity through extra probes and faster timing, which is contrary to the client's caution about legacy devices. A UDP-only scan fails to identify TCP services, and a full TCP connect scan is usually noisier because it completes the handshake. This aligns with Nmap usage guidance and common penetration-testing best practices: choose the least intrusive scan that still satisfies the objective, especially in production environments with fragile hosts and active monitoring.
- A. Correct.
Correct. A TCP SYN scan (
-sS) is commonly used to identify open TCP ports efficiently while avoiding the full TCP three-way handshake for every connection attempt. Combined with a conservative timing template like-T2, it reduces scan intensity and network noise, making it more suitable for fragile or legacy systems. This approach balances accuracy, speed, and reduced impact, which fits the scenario's requirement to minimize disruption while still identifying live hosts and exposed TCP services. - B. Incorrect.
Incorrect.
-Aenables aggressive features such as OS detection, version detection, script scanning, and traceroute, which significantly increases probe volume and intrusiveness.-T5is Nmap's most aggressive timing template and is inappropriate for legacy systems or environments where minimizing IDS alerts and operational risk is important. This option reflects the misconception that speed alone is the priority in a cautious internal assessment. - C. Incorrect.
Incorrect. A UDP-only scan does not meet the stated goal of determining exposed TCP services. In addition, UDP scanning is not inherently safer or quieter in practice; it can be slow, ambiguous, and may trigger ICMP rate limiting, producing incomplete results. Someone might choose this option thinking UDP is 'lighter,' but it does not align with the objective or with typical service-enumeration needs for TCP exposure.
- D. Incorrect.
Incorrect. A TCP connect scan (
-sT) completes the full TCP handshake, which is generally more visible in logs than a SYN scan and not more stealthy. Increasing parallelism further raises noise and the risk of overwhelming older systems. This option represents a common misunderstanding that a 'normal-looking' full connection is less detectable, when in fact it often leaves clearer evidence on targets and monitoring systems.