mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester is performing active…
A penetration tester is performing active reconnaissance on a target network. The tester wants to identify all live hosts in the 192.168.1.0/24 subnet and determine which ones have port 80 open. Which technique is most efficient for this task?
⚠ Common exam trap
Watch out — candidates often choose option C, thinking that skipping ping probing saves time, but they overlook the inefficiency of scanning all 256 IPs (including many dead hosts) versus first identifying live hosts to reduce the scan scope.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a ping sweep to identify live hosts, then run a SYN scan on port 80 for those hosts.
It combines two efficient steps: first, a ping sweep (ICMP Echo Request or ARP scan) identifies live hosts in the 192.168.1.0/24 subnet, reducing the number of targets; second, a SYN scan on port 80 for only those live hosts is faster and less intrusive than scanning all ports or all IPs without prior host discovery. This approach minimizes network traffic and scan time while accurately identifying hosts with HTTP services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perform a full TCP connect scan on all 65535 ports for each IP address.
Why it's wrong here
Performing a full TCP connect scan against every port on every IP address is extremely inefficient because it does not first filter for live hosts; a large portion of the 256 IPs may be offline, and scanning all 65,535 ports on dead hosts wastes time and bandwidth. Additionally, TCP connect scans complete the full three-way handshake, making them slower and far more conspicuous than SYN scans, potentially triggering IDS/IPS alerts. Since the objective is to check only port 80, this approach generates an unnecessary volume of traffic and does not prioritize host discovery.
- ✓
Use a ping sweep to identify live hosts, then run a SYN scan on port 80 for those hosts.
Why this is correct
A ping sweep quickly identifies which IPs in the subnet are responsive, allowing the tester to focus scanning effort on live targets only. A SYN scan sends a single SYN packet and evaluates the response without completing the handshake, making it faster and less likely to be logged than a full connect scan. Running the SYN scan on only port 80 for the discovered live hosts is efficient and directly addresses the objective of finding web servers, minimizing traffic and detection risk.
- ✗
Run a SYN scan on port 80 for every IP in the subnet without ping probing.
Why it's wrong here
This approach sends a SYN packet to port 80 on every address in the subnet, including the significant number that are not assigned or are offline, generating unnecessary broadcast-level traffic and elongating the scan window. Without a preceding ping sweep, the tester wastes time waiting for timeouts on non-responsive addresses, and the extra probe traffic increases the chance of detection by network monitoring. While the scope is limited to one port, it still scans a full /24 regardless of host liveness, making it a less efficient active reconnaissance technique.
- ✗
Use ARP requests to map the subnet and then check for port 80 on each host.
Why it's wrong here
ARP request sweeps are only effective within a directly attached broadcast domain because they rely on the Layer 2 address resolution protocol, which does not cross routers. Even when they successfully return MAC addresses, they only confirm which IPs are actively answering ARP on that local link; they do not indicate whether a host has port 80 open or is reachable via routable IP. Since active recon against a remote subnet would require IP-based probes, this method is not a reliable or general-purpose way to map hosts for a subsequent port scan.
Visual reference
Go deeper
Related to this question
About these practice questions
This PT0-003 question is part of Courseiva's 185-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.