312-50 Question 67
Single answer▪ Port and Service DiscoveryDuring an authorized internal assessment, you need to identify which services are running on a Linux server at 10.10.20.15 while minimizing the chance of triggering legacy IDS signatures that alert on full TCP connect scans. You still need reasonably accurate service identification on the ports you discover. Which Nmap command is the best choice for this requirement?
- A
nmap -sT -sV 10.10.20.15
- B
nmap -sS -sV 10.10.20.15
- C
nmap -sU -sV 10.10.20.15
- D
nmap -sn -sV 10.10.20.15
Show answer and explanation
Correct answer: B
Explanation
For CEH-level port and service discovery, the assessor must choose a scan type that matches both the technical goal and the operational constraint. Nmap's SYN scan (-sS) is the standard choice when the tester wants efficient TCP port discovery with less visibility than a full TCP connect scan (-sT). Pairing it with version detection (-sV) enables practical service identification after open ports are found. By contrast, -sT completes the handshake and is more easily logged, -sU is specific to UDP and not a replacement for TCP service enumeration, and -sn only checks host availability. This aligns with Nmap documentation and common penetration-testing methodology: first identify reachable hosts, then enumerate open ports, then fingerprint services on those ports using the least noisy appropriate technique.
- A. Incorrect.
Incorrect. The -sT option performs a TCP connect scan, which completes the full three-way handshake through the operating system's connect() call. This is often more likely to be logged by the target and more commonly matched by older IDS rules than a SYN scan. Although -sV would provide service version detection, this option does not satisfy the requirement to reduce alerts associated with full connect scans.
- B. Correct.
Correct. The -sS option performs a TCP SYN scan, commonly called a half-open scan. It sends a SYN and evaluates the response without completing the full TCP connection, which generally reduces noise compared to -sT and is a standard technique for port discovery when stealth is desired. Adding -sV enables service/version detection on discovered ports, making this the best fit for the scenario.
- C. Incorrect.
Incorrect. The -sU option performs a UDP scan, which is useful for discovering UDP services such as DNS, SNMP, or TFTP, but it does not address the stated concern about avoiding full TCP connect scans for general TCP service discovery. Also, service/version detection with UDP is slower and less reliable than with TCP in many environments. This option could miss the main TCP services an assessor typically wants to enumerate first.
- D. Incorrect.
Incorrect. The -sn option disables port scanning and performs host discovery only. Since no port scan is performed, Nmap would not have the necessary open ports to probe for service/version detection in the intended way. This is a common misconception: host discovery and service discovery are separate phases.