mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester is analyzing a Bash script…
A penetration tester is analyzing a Bash script that performs network scanning. The script contains the following command: 'for ip in $(seq 1 254); do hping3 -S -p 22 -c 1 $TARGET_SUBNET.$ip 2>/dev/null | grep -q "flags=SA" && echo "$TARGET_SUBNET.$ip: open"; done'. What is the primary purpose of this script?
⚠ Common exam trap
Candidates often confuse a TCP SYN scan on a specific port with a general ICMP ping sweep, or assume that scanning port 22 automatically implies an SSH vulnerability assessment, when in fact the script only performs port discovery, not vulnerability testing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conduct a TCP SYN scan to identify hosts with port 22 open
The script uses hping3 with the -S flag (SYN) and -p 22 (port 22) to send TCP SYN packets to each IP in the target subnet. The grep -q 'flags=SA' checks for a SYN-ACK response, which indicates the port is open and listening. This is the classic behavior of a TCP SYN scan (half-open scan) to identify hosts with port 22 open.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Conduct a TCP SYN scan to identify hosts with port 22 open
Why this is correct
This is a classic TCP SYN (half-open) scan: the script sends a TCP packet with the SYN flag set to port 22 and inspects the response. Receiving a SYN-ACK indicates the port is open and accepting connections, while receiving a RST indicates it is closed or filtered. The scan never completes the three-way handshake by sending the final ACK, which is what makes it a SYN scan rather than a full connect scan.
- ✗
Perform a vulnerability assessment against SSH services
Why it's wrong here
A vulnerability assessment against SSH would go far beyond checking whether port 22 is open. It would typically involve banner grabbing to identify the SSH version, enumerating authentication methods, and sending specific probes or exploit payloads to test for known CVEs or misconfigurations. This script only detects the presence of an open port, so it cannot determine if any SSH service is actually vulnerable or even what SSH implementation is running.
- ✗
Execute an ICMP ping sweep to discover live hosts
Why it's wrong here
An ICMP ping sweep uses ICMP Echo Request packets to determine which hosts are up, not TCP packets. This script exclusively transmits TCP SYN segments to port 22, so it would miss any host that blocks ICMP or that does not have SSH running, and it also cannot discover hosts with no open port 22. Additionally, a ping sweep is a host-discovery technique, whereas this script is specifically performing a port-level connectivity check for a single service.
- ✗
Complete a full TCP three-way handshake and log successful connections
Why it's wrong here
A full TCP three-way handshake requires sending SYN, receiving SYN-ACK, and then sending the final ACK to establish a connection. This script stops after receiving SYN-ACK and never sends that final ACK, so the connection is left half-open. This distinction matters because a full connect scan would create a complete TCP session (and often be logged by the target application), whereas this half-open SYN scan is designed to avoid completing the handshake and to infer port state with minimal footprint.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 185 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.