easyMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester wants to quickly identify…
A penetration tester wants to quickly identify which of the top 100 common ports are open on a target system, while minimizing network traffic and scan time. Which Nmap command is most appropriate?
⚠ Common exam trap
It's easy for candidates to confuse `-F` with `-p-` or assume `-T5` alone is sufficient, failing to recognize that `-F` is the specific flag that restricts the scan to the top 100 ports, while `-T5` only accelerates the timing without changing the port list.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
nmap -T5 -F target
The `-T5` flag sets the fastest timing template (insane), which reduces delays and speeds up the scan, while the `-F` flag (fast mode) limits scanning to only the top 100 most common ports as defined in Nmap's nmap-services file. This combination minimizes network traffic and scan time while quickly identifying open ports among the top 100, aligning with the goal of efficiency.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
nmap -p- target
Why it's wrong here
The -p- flag instructs Nmap to scan all 65,535 TCP ports sequentially. Even with aggressive timing templates, this full-range enumeration takes substantially longer than a top-ports scan and generates significantly more network traffic. For the stated goal of quickly identifying which of the top ports are open, this option is overkill and will not provide faster results.
- ✓
nmap -T5 -F target
Why this is correct
The -T5 flag applies the 'insane' timing template, which aggressively reduces timeouts and increases probe parallelism to maximize scanning speed. The -F flag limits the scan to the top 100 most commonly open ports (per Nmap's services database), ensuring that only high-probability targets are probed. Together, these options provide the fastest method to discover which of the top ports are listening, which matches the penetration tester's objective.
- ✗
nmap -sn target
Why it's wrong here
The -sn flag tells Nmap to perform a ping sweep (host discovery) without any port scanning. It sends ICMP echo requests, TCP SYN packets to port 443, and/or TCP ACK packets to determine if hosts are alive, but it never attempts to enumerate open TCP or UDP ports. Therefore, this option cannot identify any open ports and is entirely unsuitable for the task.
- ✗
nmap -sV target
Why it's wrong here
The -sV flag enables version detection, which sends additional probes to open ports to identify the exact service and version running. This process is inherently slower because Nmap must wait for banner responses and may perform multiple connection attempts per port. Additionally, without being combined with -F, -sV will scan all default ports or whatever port range is specified, not specifically the top ports, making it a poor choice for a quick top-ports assessment.
Go deeper
Related to this question
About these practice questions
This PT0-003 question is part of Courseiva's 185-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.