312-50 Question 65
Single answer▪ Host DiscoveryDuring an authorized internal assessment, you are told that the target subnet 10.20.30.0/24 is protected by host-based firewalls that drop ICMP echo requests. You need to identify which systems are up while minimizing unnecessary port scanning. Which Nmap approach is the most appropriate for host discovery in this situation?
- A
nmap -sn -PS80,443 10.20.30.0/24
- B
nmap -sS -p- 10.20.30.0/24
- C
nmap -sn -PE 10.20.30.0/24
- D
nmap -O 10.20.30.0/24
Show answer and explanation
Correct answer: A
Explanation
When ICMP echo requests are filtered, relying on ping-only discovery can miss active hosts. Nmap supports multiple host discovery methods, including ICMP, TCP SYN ping (-PS), TCP ACK ping (-PA), UDP ping (-PU), and ARP discovery on local Ethernet networks. In environments where ICMP is blocked, TCP-based discovery to likely permitted ports is a practical and commonly recommended approach. Using -sn avoids a full port scan and limits activity to host discovery probes, which is preferable during the reconnaissance phase. This behavior is documented in the Nmap Reference Guide under host discovery options, where Nmap explains how different probe types can be used depending on firewall behavior and network position.
- A. Correct.
Correct. The -sn option performs host discovery without a port scan, and -PS80,443 sends TCP SYN probes to common ports to determine whether hosts are up. This is appropriate when ICMP echo is blocked but systems may still respond to TCP-based discovery on commonly allowed ports such as 80 and 443. It also aligns with the requirement to minimize unnecessary port scanning.
- B. Incorrect.
Incorrect. The -sS option performs a TCP SYN port scan, and -p- scans all 65535 TCP ports. While it may reveal live hosts, it is far more intrusive than necessary for simple host discovery and does not meet the requirement to minimize unnecessary scanning.
- C. Incorrect.
Incorrect. The -PE option uses ICMP echo requests for host discovery. In this scenario, host-based firewalls are known to drop ICMP echo requests, so this method is likely to miss live systems and produce false negatives.
- D. Incorrect.
Incorrect. The -O option enables OS detection, which requires finding an open and a closed port and is not intended as a minimal host discovery technique. It is more intrusive and less suitable when the goal is simply to identify live hosts efficiently.