312-50 Question 64
Single answer▪ Host DiscoveryDuring an internal assessment, you are asked to identify live hosts in the 10.20.30.0/24 subnet while minimizing the chance of missing systems that block ICMP echo requests at the host firewall. You have authorization to scan, but the client warns that some Windows and Linux servers drop ping requests even though they are online. Which Nmap command is the most appropriate first step for host discovery in this situation?
- A
nmap -sn 10.20.30.0/24
- B
nmap -Pn 10.20.30.0/24
- C
nmap -sn -PS80,443,22 -PA80,443,22 10.20.30.0/24
- D
nmap -sS -p 1-65535 10.20.30.0/24
Show answer and explanation
Correct answer: C
Explanation
For host discovery, the goal is to determine which IP addresses correspond to live systems before running deeper enumeration. In environments where ICMP echo requests are filtered, TCP-based host discovery is often more reliable. Nmap supports several host discovery probes, including ICMP and TCP methods such as SYN ping (-PS) and ACK ping (-PA). Using -sn avoids a full port scan and focuses only on determining host availability. Customizing the probes to common ports like 22, 80, and 443 increases the likelihood of receiving a response from online hosts even when ping is blocked. By contrast, -Pn disables host discovery entirely and is typically used only when you already know targets should be scanned despite filtered discovery probes. This aligns with Nmap best practices described in the Nmap Reference Guide for host discovery and probe selection.
- A. Incorrect.
This performs host discovery only (-sn) using Nmap's default discovery methods, which commonly include ICMP echo, ICMP timestamp, TCP SYN to port 443, and TCP ACK to port 80 for privileged users. While this can work in many environments, it is less targeted for the stated problem because the client specifically warned that ICMP echo may be blocked. Relying on defaults may miss hosts if the default probes are filtered or if the environment responds better on other common ports such as 22.
- B. Incorrect.
This tells Nmap to skip host discovery and treat all targets as online. It can be useful when discovery probes are blocked, but it does not actually help identify which hosts are alive before further scanning. On a /24 network, this would force Nmap to proceed against every address, increasing noise and time. The question asks for the most appropriate first step for host discovery, so skipping discovery is not the best answer.
- C. Correct.
This is the best choice. The -sn option performs host discovery without a port scan, and the custom TCP SYN ping (-PS) plus TCP ACK ping (-PA) to common ports such as 80, 443, and 22 improves the chance of finding hosts that block ICMP echo but still respond to TCP-based probes. This is a practical approach in enterprise environments where host firewalls often filter ping but permit traffic related to common services or generate TCP responses that confirm the host is up.
- D. Incorrect.
This launches a full TCP SYN port scan across all 65,535 TCP ports on every target. Although live hosts may be revealed during the process, this is not an efficient or appropriate first step for host discovery. It is far noisier than necessary, takes significantly longer, and does not align with the requirement to minimize unnecessary scanning while identifying active systems.