312-50 Question 68
Single answer▪ Port and Service DiscoveryDuring an authorized internal assessment, you need to identify which services are actually listening on a Linux server at 10.10.20.15. The client warns you that the host-based firewall rate-limits connection attempts, so a very fast scan may miss ports or produce unreliable results. You want to discover open TCP ports first and then determine the service and version running on those ports while minimizing unnecessary traffic. Which Nmap command is the most appropriate?
- A
nmap -sS -sV -T2 -p- 10.10.20.15
- B
nmap -sU -sV -T5 -F 10.10.20.15
- C
nmap -sn -O 10.10.20.15
- D
nmap -sA -sV --top-ports 100 10.10.20.15
Show answer and explanation
Correct answer: A
Explanation
For CEH-level port and service discovery, the best practice is to match the scan type to the protocol and objective. To identify listening TCP services, Nmap's SYN scan (-sS) is a standard choice when raw packet privileges are available. Service/version detection (-sV) is then used to probe open ports and identify the application and version when possible. In environments where controls rate-limit or react to aggressive probing, slower timing such as -T2 can improve accuracy and reduce dropped probes. Using -p- ensures full TCP coverage instead of restricting discovery to common ports. By contrast, UDP scanning (-sU), host discovery only (-sn), OS detection (-O), and ACK scanning (-sA) serve different purposes and do not best satisfy the requirement. These behaviors are consistent with Nmap documentation for scan types, service/version detection, timing templates, and port specification.
- A. Correct.
Correct. A SYN scan (-sS) is appropriate for TCP port discovery, and service/version detection (-sV) is the correct follow-up to identify what is listening on the discovered ports. Using -p- scans all 65,535 TCP ports instead of only common ones, which is useful when you want comprehensive port and service discovery. The slower timing template (-T2) helps reduce packet rate and improves reliability when firewalls or IDS/IPS devices rate-limit or react poorly to aggressive scans.
- B. Incorrect.
Incorrect. -sU performs a UDP scan, but the scenario specifically asks to find listening TCP services first. -F scans only a reduced list of common ports, which can miss services on nonstandard ports. -T5 is very aggressive and is more likely to trigger rate limits or produce inaccurate results in this scenario. Although -sV is valid for service detection, the rest of the command does not match the requirement.
- C. Incorrect.
Incorrect. -sn disables port scanning and performs host discovery only, so it will not identify open ports or listening services. -O attempts OS detection, which is not the primary objective here and generally requires suitable open and closed ports to be effective. This option reflects the misconception that host discovery and OS fingerprinting can replace port and service enumeration.
- D. Incorrect.
Incorrect. -sA is an ACK scan, which is primarily used to map firewall rules and determine whether ports are filtered or unfiltered; it does not determine whether a TCP port is open in the same way a SYN or connect scan does. Combining -sA with -sV is not appropriate for reliable service identification. --top-ports 100 also limits coverage and may miss relevant services running on uncommon ports.