easyMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester runs the following command:…
A penetration tester runs the following command: nmap -sS -p 1-65535 -T4 -A -O --reason target. What is the primary purpose of the -A option in this command?
⚠ Common exam trap
Candidates often confuse the 'aggressive' label of -A with nmap's timing templates (e.g., -T4 or -T5), which are actually named 'aggressive' and 'insane' in the documentation, leading them to incorrectly associate -A with scan speed or detectability rather than its true composite functionality.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enables OS detection, version detection, script scanning, and traceroute.
The -A option in nmap is a composite flag that enables OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute (--traceroute) in a single switch. This is explicitly documented in nmap's man page and is designed to provide comprehensive reconnaissance in one command, making option A correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enables OS detection, version detection, script scanning, and traceroute.
Why this is correct
The -A flag in Nmap is a convenience option that aggregates several detection features: it enables operating system detection (-O), version detection (-sV), default script scanning (-sC), and traceroute (--traceroute) in a single command. Rather than specifying each flag individually, -A gives a comprehensive profile of the target's OS, services, and network path, making it a common choice for initial reconnaissance during a penetration test.
- ✗
Sets the timing template to aggressive (level 4).
Why it's wrong here
-T4 is the Nmap timing template that sets the 'aggressive' level (4 out of 5), controlling packet send rates and timeouts. The -A flag, however, has no effect on timing; it only combines detection features like OS fingerprinting and script scanning. An Nmap user would use -T4 separately to speed up a scan, and it can be combined with -A or any other scan type.
- ✗
Enables aggressive scanning that is more likely to be detected by the target.
Why it's wrong here
While -A can generate more network traffic and noise because it runs multiple scans (OS detection, version detection, and scripts), the term 'aggressive scanning' in Nmap officially refers to the timing template -T4, not to -A. The -A flag is about the depth of information gathered, not the speed or stealth profile of the scan, so calling -A 'aggressive' conflates two distinct concepts.
- ✗
Performs a SYN (half-open) scan.
Why it's wrong here
A SYN (half-open) scan is specified by the -sS flag, which sets the scan type; it sends a TCP SYN packet and observes the response without completing the handshake. The -A flag is independent of the scan type and can be combined with -sS, -sT, or other scan types, as it only toggles detection features like OS and version detection. Therefore, -A does not itself perform a SYN scan.
Go deeper
Related to this question
About these practice questions
One of 185 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.