easyMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester wants to perform a network…
A penetration tester wants to perform a network scan that minimizes the chance of detection by an intrusion detection system (IDS). Which Nmap timing template is MOST appropriate?
⚠ Common exam trap
Many exam-takers choose -T2 (Polite) thinking it is slow enough to evade detection, but they fail to recognize that -T0 is the only template specifically designed for IDS evasion with delays measured in minutes, not seconds.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
-T0
The -T0 (Paranoid) timing template is the most appropriate for minimizing detection by an IDS because it introduces extreme delays between packet transmissions (up to 5 minutes between probes) and uses a very slow scan rate. This makes the scan traffic blend into normal network noise, reducing the likelihood of triggering signature-based or anomaly-based IDS alerts that rely on detecting rapid, sequential connection attempts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
-T0
Why this is correct
The -T0 (paranoid) timing template is the slowest Nmap profile, inserting very large delays between consecutive probes and setting `max-scan-delay` to five minutes. It deliberately operates well below rate-based IDS thresholds to avoid detection, making it the most appropriate choice when stealth is the priority. However, this thorough avoidance comes at the cost of dramatically increased scan duration.
- ✗
-T3
Why it's wrong here
The -T3 (normal) template is Nmap's default timing, balancing speed and reliability, but it uses standard TCP connect or SYN scan rates that are easily recognized by signature-based IDS/IPS sensors. Because there are no intentional delays between probes and parallelism can reach ten or more open ports, the resulting cadence is well within the range that triggers common network intrusion alerts. Thus, for a scan requiring covertness, the default timing is usually too conspicuous.
- ✗
-T5
Why it's wrong here
The -T5 (insane) template is designed for maximum speed, setting `max-parallelism` at 32 and drastically reducing timeout values so probes are launched as fast as possible. This aggressive behavior rapidly generates dense packet bursts that trip most rate-based intrusion detection systems and may even saturate network links, making it the least suitable option for a stealthy scan. It is only appropriate on fast internal networks when detection is not a concern.
- ✗
-T2
Why it's wrong here
The -T2 (polite) template reduces scan rates to minimize network load, adding a delay of 0.4 seconds between probes, but it does not slow the scan to the paranoid level of -T0. This pace can still exceed the threshold of finely tuned IDS sensors, particularly when scanning multiple ports or hosts, because the cumulative packet rate remains high. It is designed more for avoiding network congestion than for evading security monitoring.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.