312-50 Question 63
Single answer▪ Scanning ToolsDuring an internal assessment, you are asked to identify live hosts and determine which TCP services are exposed on a /24 subnet without triggering IPS signatures tied to full TCP connects. You also need reasonably accurate service version information for remediation planning. Which scanning approach is the most appropriate?
- A
Use Nmap with a SYN scan and version detection, such as nmap -sS -sV 10.10.20.0/24
- B
Use Nmap with a TCP connect scan only, such as nmap -sT 10.10.20.0/24
- C
Use a UDP-only scan, such as nmap -sU -sV 10.10.20.0/24
- D
Use Netcat to connect manually to common ports on each host and record the banners
Show answer and explanation
Correct answer: A
Explanation
The best choice is an Nmap SYN scan with version detection. In real assessments, Nmap is a standard scanning tool because it supports host discovery, port scanning, and service/version detection in a single workflow. A SYN scan (-sS) is commonly preferred when the tester wants to reduce the noise associated with full TCP connect scans, because it sends a SYN and interprets the response without fully establishing the session. Service detection (-sV) then probes identified ports to infer the application and version, which supports remediation planning and follow-on validation. This aligns with Nmap documentation and common penetration testing practice: choose scan types based on the protocol of interest, desired stealth, and information needed. By contrast, -sT is more detectable due to completed connections, -sU targets the wrong protocol family for the stated objective, and Netcat is better suited for targeted manual checks than subnet-wide service enumeration.
- A. Correct.
Correct. An Nmap SYN scan (-sS) is a half-open scan that does not complete the full TCP three-way handshake, making it less noisy than a TCP connect scan while still being highly effective for identifying open TCP ports. Adding version detection (-sV) helps determine the likely service and version running on discovered ports, which is valuable for remediation and vulnerability validation. This directly fits the requirement to identify live hosts and exposed TCP services while reducing the chance of triggering controls that look for full TCP connects.
- B. Incorrect.
Incorrect. A TCP connect scan (-sT) completes the full TCP handshake using the operating system's connect() call. While it can reliably identify open ports, it is generally noisier and more likely to be logged or detected by monitoring tools and IPS signatures tied to completed connections. It also does not, by itself, provide service version information unless additional options are used.
- C. Incorrect.
Incorrect. A UDP scan (-sU) is intended for discovering UDP services, not TCP services. The scenario specifically asks for exposed TCP services. Although some environments require UDP scanning as part of a full assessment, using UDP-only scanning here would miss the target requirement and would often be slower and less reliable for this objective.
- D. Incorrect.
Incorrect. Netcat can be useful for manual banner grabbing or quick validation of individual ports, but it is not the most appropriate tool for efficiently scanning an entire /24 subnet for live hosts and TCP services. Manual connections are time-consuming, less systematic, and more likely to create full connections that may trigger the very detections the assessor is trying to avoid.