CCNA Reconnaissance and Enumeration Questions

crt.sh is a dedicated Certificate Transparency (CT) log search engine that aggregates and indexes certificates from multiple CT logs, allowing rapid lookups by domain, issuer, or serial number. It directly queries the CT framework's public, append-only logs via a web interface and API, making it the precise tool for checking which certificates have been issued for a domain, including your own. This is why it is the correct answer.

WPScan is a dedicated WordPress vulnerability scanner that enumerates installed plugins, themes and users, then checks them against known vulnerability databases and tests for weak credentials. Generic web scanners lack this WordPress-specific enumeration and detection logic.

SYN scan (-sS) sends a bare SYN packet to each port, and if a SYN/ACK is returned, the port is considered open; the scan then immediately replies with an RST to tear down the half-open connection before the handshake completes. This avoids creating a full TCP session, so the target application never sees a completed connection, making it far less likely to appear in application-level logs. Because it sends raw packets, it requires root or CAP_NET_RAW privileges, but it is the default and fastest scan type in Nmap. It is not completely invisible—stateful firewalls can still detect the unprompted SYN/ACK followed by RST—but it is significantly more stealthy than a full connect scan.

LinkFinder parses JavaScript files with regular expressions to extract URL paths, relative endpoints and API routes embedded in client-side code, directly satisfying the requirement to enumerate endpoints. Unlike generic secret scanners, it targets endpoint discovery specifically, making it effective when reviewing minified or bundled JavaScript for hidden API surfaces.

theHarvester is a passive OSINT tool that aggregates emails, subdomains, hostnames, and employee names from public data sources such as search engines, PGP key servers, and certificate transparency logs. It performs this collection without directly contacting the target servers, thus qualifying as passive reconnaissance. The gathered data helps penetration testers map an organization's external attack surface and identify potential entry points for social engineering or credential attacks.

-sn performs host discovery only (ping sweep) without port scanning, meeting the requirement.

theHarvester queries public sources such as search engines, PGP key servers and certificate transparency logs to harvest domain names, email addresses and subdomains. This satisfies the passive constraint because it never sends traffic directly to the target's own systems.

The -sn switch, previously called -sP, disables port scanning and instructs Nmap to perform only host discovery, commonly known as a ping sweep. Nmap sends a mix of ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests, and any positive response marks the host as alive. This is the fastest and quietest way to enumerate responsive systems on 192.168.1.0/24 without revealing which services are open.

WHOIS is a standard query/response protocol, usually over TCP port 43, that retrieves the authoritative registration record for a domain from the registry and registrar databases, including registrant and administrative contacts, creation/expiration timestamps, nameservers, and registrar identity. For a penetration tester, performing a passive WHOIS lookup during the information-gathering phase is the direct way to obtain domain registration details and can yield nameservers for later DNS enumeration or contact references for social engineering. Therefore, WHOIS is the correct answer because it specifically returns the registration information requested.

Zone transfers use the AXFR query type to replicate an entire DNS zone. The server's allow-transfer ACL determines which IP addresses may request a full zone copy; when the tester's source IP is not in that list, the server typically responds with a REFUSED or 'Transfer failed' error while still answering normal recursive/authoritative queries, so the attempt appears blocked.

The -sS TCP SYN half-open scan sends a SYN, reads the SYN-ACK, then tears down with RST before the connection completes. Because no session is established, most application and host logging never records it, satisfying the stem's stealth requirement.

theHarvester is the correct answer because it is a dedicated OSINT tool engineered to passively gather emails, subdomains, hostnames, and employee names from public sources. It queries search engines like Bing and Google, PGP key servers, and other open data repositories, making it ideal for the early reconnaissance phase of a penetration test. Its specific focus on email harvesting and subdomain enumeration aligns precisely with the task of gathering information about an organization's digital footprint, unlike general-purpose scanners or link-analysis platforms.

dnsrecon is a dedicated DNS enumeration tool that can query name servers for records such as MX, NS, and A, and can attempt zone transfers and brute-force subdomains. It works without credentials and is designed for the exact task of DNS reconnaissance, making it the most appropriate choice for identifying mail servers and subdomains.

Arjun discovers hidden API parameters and endpoints through its extensive wordlists and passive/active scanning, while ffuf fuzzes directories, parameters and virtual hosts at high speed. Together they satisfy the stem's need to uncover endpoints and hidden parameters in a web application.

theHarvester is a passive OSINT tool that aggregates publicly accessible information from third-party sources such as search engines, PGP key servers, and certificate transparency logs to collect email addresses, subdomains, hosts, and employee names for a given domain. It never sends packets directly to the target's own infrastructure, so it does not trigger target-side monitoring or violate the passive reconnaissance constraint. Its value lies in building a pre-attack picture of the attack surface from information already available on the internet, making it ideal for the passive phase.

A false positive is an alert that a vulnerability scanner generates for a condition that, upon manual verification, does not actually exist. This is precisely what happened here: the scanner flagged a weakness, but penetration testing proved it was not present. Such alerts require triage to filter noise and avoid wasting remediation effort.

snmpwalk is the canonical command-line utility for actively enumerating SNMP-enabled devices, sending a sequence of GETNEXT requests to traverse the entire Management Information Base (MIB) tree. By default, it uses the community string 'public' via SNMPv2c, and a successful walk quickly reveals system name, interfaces, contacts, and even process tables—data that is extremely valuable during active reconnaissance. Unlike generic scanners, snmpwalk specifically implements the SNMP protocol and is designed to extract the full OID hierarchy in one pass.

Attempting to exploit the identified vulnerability using a known, publicly available exploit (e.g., a Metasploit module or a PoC from Exploit-DB) is the definitive validation step in penetration testing. It transforms a potential false positive into demonstrated proof by showing that the service is actually vulnerable and the exploit path yields a controlled outcome. This must be executed with explicit authorization and caution, as a failed or unstable exploit could crash the target service, and the tester should gain approval for any exploit that may have a destructive impact. The successful execution provides concrete evidence, including command output and system access, that is far more persuasive to the client than a simple version-match.

A false positive is an incorrect alert in which the scanner reports a vulnerability that does not actually exist in the web application, such as flagging a sanitized input parameter as SQL injectable. This often occurs due to heuristic detection misfires, outdated signature databases, or responses that imitate vulnerability patterns without the underlying weakness. It consumes security team time and resources on investigating and remediating non-existent issues, highlighting why every automated finding should be validated before being acted upon.

Nessus is a commercial vulnerability scanner that supports credentialed scans via protocols like SSH, WinRM, or SMB, enabling deep assessment of Windows patch levels, service configurations, and custom software. It uses a comprehensive plugin database (e.g., via Nessus or the free Nessus Essentials) to map system state to known vulnerabilities, including missing patches, weak permissions, and policy violations. For authenticated Windows scanning, it connects with provided credentials (local or domain) to query WMI and the registry, making it the correct tool for this task.

Searching Pastebin for leaked credentials involves querying a third-party data-sharing site rather than touching the target's infrastructure, so no packets reach the organisation's systems. This satisfies the stem's passive reconnaissance constraint, since the tester gathers intelligence without directly interacting with the target's hosts, domains, or network ranges.

ffuf brute-forces web paths and parameter names using wordlists, directly satisfying the requirement to discover hidden API endpoints and parameters during reconnaissance. Its fuzzing engine substitutes payloads into URL paths or query strings, revealing resources that normal browsing misses, making it appropriate alongside other content-discovery tools.

ARP scan with arp-scan is the correct choice because ARP requests operate at Layer 2, directly querying each host on the local broadcast domain. Since ARP traffic is encapsulated in Ethernet frames, IP-based firewalls and host-based packet filters cannot intercept or block these probes, making ARP the most reliable method for discovering live hosts on the same subnet. Additionally, arp-scan sends gratuitous ARP requests and parses replies, efficiently mapping all active MAC and IP addresses without relying on higher-layer protocols.

Certificate transparency logs are a passive discovery resource because they are publicly available, append-only ledgers maintained by independent log operators, and querying them does not involve sending any packets to the target organization's own servers or infrastructure. Services like crt.sh or Censys provide APIs that return certificates issued for a domain, often revealing subdomains, wildcard entries, and even expired certificates that were previously in use. This method leaves no trace on the target's DNS logs, web servers, or intrusion detection systems, making it a classic OSINT/ passive-recon technique. For a penetration tester, it provides a high-yield, low-risk baseline for expanding the attack surface before active testing begins.

Historical snapshots stored by the Internet Archive capture the target's web pages at various points in time. Penetration testers can mine these archives to locate old URLs, deprecated backup files, configuration snippets, or even credentials that were inadvertently posted before being removed from the live site. This passive intelligence gathering expands the attack surface by exposing forgotten endpoints that no longer appear in current site maps.

Maltego is a passive OSINT and data-mining tool that aggregates information from public sources such as social media, DNS records, and certificate transparency logs. It uses transforms to pivot between entities — for example, from a domain to an employee email, then to a linked social profile — revealing organizational relationships without ever touching the target's infrastructure. This relationship graphing makes it ideal for passively mapping an organization's attack surface and employee information.

feroxbuster is a high-performance, Rust-based directory and file bruteforcer built for web content discovery. It uses asynchronous I/O and parallel HTTP requests to rapidly enumerate hidden paths, and its automatic recursion (with the -r flag) lets it descend into discovered directories without manual rescanning. Features like extensions, filters on status codes/sizes, and the --extract-links option to mine further paths from response bodies make it a precise and efficient choice for this phase of recon.

Version-based detection is a heuristic where the scanner matches a service's banner or fingerprint against a vulnerability database; if the version string is parsed incorrectly or the banner is outdated, false positives occur. For example, a web server with a backported security patch may still display an old version number, leading the scanner to flag a vulnerability that is not actually present. This is a well-known limitation of unauthenticated scanning and a common cause of erroneous positive reports.

filetype:pdf restricts Google's index to files with the PDF extension, which is ideal for information gathering because PDFs published on a target domain—such as user guides, annual reports, or internal memos—frequently contain metadata, employee names, and technology stack details that are not visible in ordinary HTML pages. During passive reconnaissance, this operator narrows results to a discrete document format that often escapes normal web crawling and may reveal sensitive or forgotten disclosures.

Manually verifying a subset of the findings is the correct next step after an automated scan, because tools like Nikto rely on signature matching and often produce false positives that don't reflect the actual application behavior. By using techniques such as inspecting raw HTTP responses, confirming server headers, or re-checking vulnerable files with curl, the tester can confirm whether a finding represents a genuine vulnerability, gauge the scanner's accuracy, and prioritize remediation based on validated evidence.

Feroxbuster is a Rust-based recursive content discovery tool designed specifically for brute-forcing web directories and files, including API endpoints. It uses dictionary-based wordlists, supports status-code and size filtering, and can recurse into discovered directories, making it effective for mapping undocumented API routes. Its speed and flexibility with custom headers, request methods, and extension fuzzing make it the correct tool for this task.

Shodan continuously probes public IP ranges and collects response banners, including HTTP headers, SSH keys, and SNMP strings, which it indexes for instant querying. This enables a pen tester to identify specific device types, software versions, and open ports on a global scale, making it an invaluable reconnaissance tool prior to close-in testing. It allows searching by filter such as 'port:22', 'product:Apache', or 'country:US'.

The -sS option, Nmap's default SYN scan, transmits a raw TCP packet with only the SYN flag set to each port; an open port replies with a SYN/ACK, a closed port with an RST, and a filtered port drops the packet or returns an ICMP unreachable. Because Nmap aborts the handshake immediately upon receiving SYN/ACK, it determines TCP port state without ever completing a full connection, making it fast and relatively unobtrusive.

Querying certificate transparency logs is passive because these logs are publicly auditable ledgers of all issued TLS/SSL certificates, maintained by independent log operators like Google and Cloudflare. An attacker can query them via services such as crt.sh or the ct.googleapis.com API to discover subdomains and certificate details without ever sending a packet to the target's own infrastructure, thereby leaving no trace in the target's logs.

theHarvester is built for OSINT gathering and can query search engines, certificate transparency logs, and other public sources without sending traffic to the target. It returns emails, hostnames, and employee names, matching the passive requirement. It does not need credentials or direct target access, so it avoids alerting the target while still producing actionable reconnaissance data.

When Nmap receives no response (or an ICMP unreachable message, such as type 3 code 13, administratively prohibited) to a SYN probe to a specific port, it labels that port 'filtered'. This indicates that a firewall or packet-filtering device is interfering with the probe, either by dropping the packet silently or by sending back a rejection message. Consequently, Nmap cannot definitively determine whether the port is open or closed because it lacks a TCP-level response like SYN/ACK or RST. This is a common result when stateful firewalls inspect and block unsolicited inbound packets during active reconnaissance.

arp-scan sends ARP requests, which operate at layer 2, so it discovers live hosts on the local subnet without transmitting IP packets. In a switched Ethernet environment this bypasses router boundaries and reliably maps active devices by MAC address.

WPScan is purpose-built for WordPress security assessments: it queries the WPScan vulnerability database, enumerates installed plugins, themes, and users, and can test for weak credentials against wp-login. Its fingerprinting goes beyond generic HTTP probing, identifying specific core versions and CVEs, making it the correct choice for a WordPress web application assessment.

theHarvester is an OSINT tool that passively aggregates data by querying public APIs and search engines such as Shodan and Google dorks. It searches publicly indexed emails, subdomains, and hostnames without ever sending packets directly to the target's own systems, preserving anonymity and leaving no traces in target logs. This makes it a legitimate passive reconnaissance technique.

The -A flag is Nmap's built-in alias for aggressive scanning, expanding to -O (OS detection), -sV (version detection), -sC (default NSE scripts), and --traceroute. This single command gives a penetration tester the full suite of enumeration techniques in one pass, which is exactly what the question's 'aggressive' wording refers to. Keep in mind that -A can be intrusive and generate significant network traffic, but that is the intended trade-off for thorough reconnaissance.

-x is the correct flag for this scenario because it appends a comma-separated list of file extensions to each word from the wordlist when fuzzing directories. For example, using -x php,bak makes Gobuster test each word as-is, then with .php appended, and then with .bak appended, which is exactly how a tester discovers hidden backup files such as index.php.bak. Without this flag, Gobuster only requests the literal word paths, missing extension-based files entirely. This is why -x is the right answer for enumerating files with specific suffixes.

Nikto is a purpose-built web server vulnerability scanner that performs automated HTTP/HTTPS checks for over 7,000 potentially dangerous files and programs, outdated server software, and server misconfigurations, such as insecure HTTP methods and default credentials. It inspects response headers and content to fingerprint the exact server version and cross-references it against known vulnerabilities, covering platforms like Apache, Nginx, and IIS. This makes 'web server vulnerability scanner' the precise and correct classification for Nikto's role in a penetration test.

crt.sh is a certificate transparency (CT) log search engine that queries public CT logs for any certificate issued for a given domain. Because every publicly trusted TLS certificate must be logged, crt.sh lets a penetration tester enumerate subdomains, including non-indexed or internal-looking hosts, simply by searching the domain name. This makes it the most direct and comprehensive source for SSL/TLS certificate information.

snmpwalk is the standard command-line tool for walking the MIB tree, using SNMP GETNEXT and GETBULK operations to sequentially retrieve all OIDs in a subtree. It recursively enumerates every accessible managed object from the root (or a specified OID), making it the definitive tool for full SNMP information disclosure testing. When an assessment requires a complete snapshot of a device's SNMP-accessible data, snmpwalk is the correct and most comprehensive choice.

Ping sweep discovers live hosts without port scanning.

Amass is a dedicated open-source subdomain enumeration and attack surface mapping tool developed under the OWASP umbrella. It aggregates passive data from a wide range of public sources—including certificate transparency logs (e.g., crt.sh), DNS archives, search engines, and security APIs like VirusTotal, Shodan, and AlienVault—then supplements that with active techniques such as DNS brute-forcing, zone transfer attempts, and recursive resolution to validate each discovered name. Its graph-based correlation engine links subdomains to related domains and IPs, uncovering infrastructure that a simple brute-forcer or directory scanner would never reveal. This makes Amass not just a subdomain finder, but a foundational tool for building a complete target asset inventory during the information gathering phase.

WPScan is the correct choice because it is a purpose-built WordPress security scanner. It enumerates WordPress core, plugin, and theme versions, checks them against known CVE databases, and can identify usernames, weak passwords, and vulnerable components. Its specialized fingerprinting engine and integration with the WPScan API give it far higher accuracy for WordPress-specific vulnerabilities than any general-purpose scanner.

This is the correct approach because Shodan's org field is populated from IP address ownership records via regional internet registries (ARIN, RIPE, APNIC, etc.) and groups every IP address registered to the organization irrespective of hostname, certificate, or service. A penetration tester can thereby enumerate the entire internet-facing footprint of the company in one query, making org:CompanyName the definitive starting point for external reconnaissance rather than relying on incomplete metadata.

This is correct because theHarvester is an open-source intelligence (OSINT) tool that collects email addresses from publicly indexed web pages, PGP keys, and other exposed data. It cannot penetrate internal directories, address books, or private mail servers, so emails that are never published online won't be discovered. The result set is limited to those addresses that the target or third parties have intentionally or accidentally made public.

Arjun is a purpose-built tool for discovering hidden GET and POST parameters. It sends requests containing candidate parameter names from a large wordlist and uses response-differential analysis—comparing status codes, response size, and reflected content—to determine whether a parameter affects the server's response. Crucially, it has heuristics for 'reflect' detection, where the parameter name or value appears in the response, a strong signal of parameter existence. This makes it ideal for finding custom parameters not advertised in the UI or API documentation.

The Wayback Machine archives historical snapshots of websites, letting the tester review past pages, retired endpoints and old vulnerabilities without touching the target. This passive source satisfies the reconnaissance requirement without generating traffic against the organisation.

Downloading and analyzing the JavaScript files is the correct approach because client-side web applications commonly expose API endpoints, authentication logic, and hardcoded secrets within their scripts. By fetching every .js file referenced by the page (including bundled and lazy-loaded modules), you can inspect source maps, search for strings like 'api/', 'token', 'secret', or 'Bearer', and reconstruct the application's internal routing. Tools like Burp Suite, Chrome DevTools, and JSParser can automate extraction, and even minified code can be beautified to reveal hidden functionality that is not visible in normal page interaction.

WPScan queries the WordPress vulnerability database and enumerates core version, plugins and themes, matching each against known CVEs. That directly satisfies the stem's requirement to identify known vulnerabilities in a WordPress installation, unlike generic scanners that lack WordPress-specific signature data.

'private' is the default read-write community string in SNMP v1 and v2c, granting full write access to the device's MIB tree. With this string, an attacker can alter configuration parameters, change routing tables, disable interfaces, or even cause a denial of service by modifying system settings. In active reconnaissance, discovering 'private' is a high-severity finding because it signals complete administrative control over the SNMP-managed device, which is exactly why it is the correct answer here.

This is the correct sequential approach: -sS performs a half-open SYN scan to quickly and quietly identify which TCP ports are open, while -sV then sends targeted service probes and performs banner grabs on those exact open ports to enumerate application versions. Separating discovery from version detection allows the tester to control scope and avoid wasting time probing closed or filtered ports. This two-phase methodology is a foundational best practice in network service enumeration.

smbclient with -L lists shares using provided credentials and does not perform password guessing, so it will not cause lockouts. It allows the tester to connect to shares the low-privileged user can access and browse files. This approach respects the credential constraint and avoids brute-force behavior that could lock the account.

Analyzing JavaScript files is the definitive technique here because modern single-page applications bundle most of their client-side logic into JavaScript. Static analysis of the code (or dynamic inspection via browser DevTools' Network tab) can reveal backend API URLs, request parameters, authentication tokens, and webpack chunk references that are never publicly documented. Source maps, if left exposed, can even reconstruct the original source to expose hidden or internal endpoints that network scanners cannot see.

crt.sh is a dedicated web service and API that aggregates and searches public Certificate Transparency (CT) logs, making it the most commonly used tool for passively discovering subdomains by querying issued SSL/TLS certificates. Because it queries the CT logs directly, it requires no interaction with the target's infrastructure and returns a comprehensive list of subdomains for free without API keys. This passive approach is a standard first step in reconnaissance during penetration testing and bug bounty engagements.

Feroxbuster is a Rust-based recursive content discovery tool specifically engineered for fast directory and file brute-forcing. It supports wordlist-driven scanning, multiple file extensions, recursion, and automatic filtering of irrelevant status codes and response sizes, allowing penetration testers to efficiently map out hidden web resources. Its speed and recursive crawling make it an excellent choice for active reconnaissance on web applications.

Correct. Ping sweep quickly identifies live hosts.

With valid credentials, the scanner can log in to the target and perform local checks, such as inspecting installed patches, configuration files, running services, and file permissions, rather than relying solely on remote banner grabbing and version inference. This enables the scanner to identify vulnerabilities that only manifest post-authentication, such as weak local security policies or missing cumulative updates, with far greater accuracy.

It's a brute-force tool that uses wordlists to discover directories and files on web servers by sending HTTP requests and matching status codes. Unlike vulnerability scanners, Gobuster focuses purely on resource enumeration, making it ideal for mapping an application's structure. In active reconnaissance, it directly interacts with the target to reveal hidden paths.

The -sn flag tells Nmap to skip port scanning entirely and perform only host discovery, sending ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and an ICMP timestamp request by default when run as root. It is the canonical ping sweep option for enumerating live hosts on a subnet without probing open ports, making it the correct choice for host discovery.

A DNS zone transfer (AXFR) is a legitimate replication mechanism that copies the entire zone file from a primary to a secondary DNS server. When misconfigured to allow unrestricted AXFR, it exposes every record in the zone, including internal host names, IP addresses, and service records, giving an attacker a complete map of the target's network. This makes it the definitive enumeration technique because it returns the full data set in one query.

-O is the correct answer because it is the dedicated Nmap flag for operating system detection. This option works by sending specially crafted TCP and UDP probes to the target and comparing the responses against Nmap's large database of OS fingerprints, thereby identifying the likely operating system. It is the precise, purpose-built switch for this task, unlike broader or unrelated flags.

Gobuster is a purpose-built content discovery tool for brute-forcing directories, files, DNS subdomains, and virtual hosts. It loads a wordlist and sends HTTP requests to the target, distinguishing valid resources by filterable response status codes (e.g., 200, 301, 403) and configurable patterns. Its multi-threading, support for file extensions, wildcard detection, and performance make it the standard choice for directory brute-forcing in penetration tests.

Manual verification entails actively reproducing the vulnerability—e.g., sending a crafted HTTP request to confirm a SQL injection, or checking if a specific CVE applies by reviewing patch levels and exploiting the target in a controlled manner. This step distinguishes real security gaps from false positives generated by the scanner, and also collects proof-of-concept evidence necessary for a credible, actionable penetration test report.

Wappalyzer is a browser extension and library that performs passive technology fingerprinting by inspecting HTTP response headers (e.g., X-Powered-By, Set-Cookie), HTML meta tags, script sources, and other client-side content returned by the web application. It does not send a single request to the target beyond what the browser itself makes, so it identifies frameworks, CMSs, analytics tools, and server software entirely from normal page loads. This makes it the correct tool for passive identification in this scenario.

Shodan is the correct answer because it is a dedicated search engine for internet-connected devices. It works by scanning the entire IPv4 (and IPv6) address space and indexing the banners returned by services like HTTP, SSH, FTP, and Telnet. Penetration testers use Shodan to quickly identify public-facing devices, exposed industrial control systems, and services running on unusual ports, making it the industry-standard tool for internet-facing device discovery.

ffuf performs fuzzing by substituting wordlist entries into request positions, detecting accepted parameters through response differences in status codes, length or reflection. This directly satisfies the stem's requirement to discover parameters the application accepts during active reconnaissance, using its `-w` wordlist and filter flags to isolate valid hits.

Arjun is a dedicated parameter discovery tool that tries thousands of common parameter names against a target endpoint and detects hidden parameters by analyzing response differences such as reflected values, status code or content-length changes, and timing anomalies. It uses a built-in curated wordlist and supports heuristics, making it far more specialized and efficient for this task than general-purpose scanners. This purpose-built design is why it is the correct answer here.

Gobuster is a tool specifically designed for brute-forcing URIs (directories and files) by systematically sending HTTP requests for each entry in a wordlist against the target web server. It is highly efficient, supporting multi-threading, status-code filtering, and extensions, making it ideal for discovering hidden or unlisted resources. Because it automates the iterative request-response cycle and parses responses for valid HTTP status codes, it is the appropriate choice for directory brute forcing in a penetration test. Unlike the other tools, it directly addresses the task of enumerating directory structure.

Authenticated scanning leverages valid credentials to log into the target OS and perform local checks, such as inspecting file permissions, registry keys, installed software versions, and missing security patches. These truly local vulnerabilities are invisible to unauthenticated network-based scans, which can only observe remotely reachable services and banners. This credential-based access is the primary technical justification for choosing an authenticated scan.

-sn instructs Nmap to skip port scanning entirely and perform host discovery only, sending a blend of ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests to see if targets respond. This quickly identifies live hosts on the 192.168.1.0/24 subnet without enumerating services, reducing time, noise, and the risk of a false negative from a single probe type. It is the correct, purpose-built flag for this task.

-sn, historically called -sP or "ping sweep," disables port scanning completely and tells Nmap to perform only host discovery, reporting every IP address that is currently reachable on the target subnet. On a local Ethernet network, Nmap uses ARP requests for discovery because they are highly reliable and cannot be filtered without breaking normal IP communications; for remote targets, it combines ICMP echo requests, TCP SYN probes to ports 80 and 443, and ICMP timestamp requests to determine liveness. This yields a fast, low-noise inventory of live systems, which is exactly the right first step when mapping an internal network after gaining initial access, before deciding which IPs warrant deeper port scanning.