easyMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester wants to identify live hosts…
A penetration tester wants to identify live hosts on a large internal network. Which Nmap option would be the FASTEST for initial host discovery?
⚠ Common exam trap
A common mix-up: candidates confuse host discovery with port scanning, assuming that a SYN scan (-sS) is the fastest because it is stealthy, but they overlook that -sn is designed specifically for host discovery and avoids the overhead of port scanning entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
-sn (Ping sweep)
The -sn option performs a ping sweep, sending ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default. It does not perform port scanning, making it the fastest method for initial host discovery on a large internal network because it only checks for host availability without enumerating services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
-sV (Version detection)
Why it's wrong here
-sV (Version detection) is a post-discovery enumeration phase: it assumes hosts are already known and ports are open, then sends crafted probes to those ports to identify the exact service and version (e.g., Apache httpd 2.4.41). It is inapplicable to host discovery because it requires a prior port scan and focuses on service banner analysis, not on determining whether a host is alive. Moreover, version detection is significantly slower than -sn because it waits for full service responses and may trigger application-level interactions.
- ✗
-sS (SYN stealth scan)
Why it's wrong here
-sS (SYN stealth scan) is a port scanning technique that sends TCP SYN packets to a range of ports on a target to detect open or filtered ports, leaving some three-way handshakes incomplete. It is not a host discovery tool: it cannot be used to identify live hosts efficiently, as it must scan every port on every IP to infer liveness, which is far more time-consuming than a simple ping sweep. Additionally, -sS requires root privileges, whereas -sn can run unprivileged, making -ss inappropriate for rapid network-wide host enumeration.
- ✓
-sn (Ping sweep)
Why this is correct
-sn (Ping sweep) is the correct option because it performs host discovery only, sending minimal probes such as ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests (depending on Nmap version and privileges) to determine which hosts respond without scanning any open ports. This makes it the fastest and most efficient method for identifying live hosts across a large subnet, as it does not wait for service banners or full port scans. The -sn flag is designed exactly for this purpose, replacing the old -sP behavior in Nmap.
- ✗
-A (Aggressive scan)
Why it's wrong here
-A (Aggressive scan) is a comprehensive scan mode that simultaneously enables OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute, each of which adds additional probes and waiting time. It is intended for in-depth analysis of a small number of already-known targets, not for initial host discovery, because running -A against an entire subnet would produce enormous traffic and take an extremely long time. Since host discovery aims to rapidly filter a list of live IPs, -A's heavy overhead is counterproductive for that early scanning phase.
Visual reference
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Active reconnaissance
Active reconnaissance is the process of directly interacting with a target system or network to gather information, often through scanning and probing.
Key term
Nmap
Nmap is a network scanning tool used to discover hosts, services, and operating systems on a computer network.
About these practice questions
This PT0-003 question is part of Courseiva's 185-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.