CEH Footprinting, Reconnaissance and Scanning Practice Question

A penetration tester runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?

⚠ Common exam trap

Candidates often confuse the -sS (SYN scan) with -sT (TCP connect scan) or -sU (UDP scan), and they may incorrectly assume that -sV and -O automatically scan all ports or perform additional enumeration like SMB sharing, when in fact the port range is explicitly limited by the -p option.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting

The command uses the -sS flag for a TCP SYN scan (stealth scan), -sV for service version detection, and -O for OS fingerprinting, targeting only the four specified ports (22, 80, 443, 3389) across the 192.168.1.0/24 subnet. This combination performs a half-open TCP scan on those ports, probes open ports to identify service versions, and attempts to determine the operating system based on TCP/IP stack responses.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Perform a UDP scan on the four specified ports and identify running services
Why it's wrong here
This statement is incorrect because the -sS flag explicitly initiates a TCP SYN scan, which is a stealthy method for identifying open TCP ports without completing the full three-way handshake. A UDP scan, designed to probe UDP services by sending UDP packets and awaiting responses or ICMP port unreachable messages, requires the -sU flag. Therefore, the command as written would not perform any UDP scanning, nor would it identify UDP services on the specified ports.
✗
Perform an aggressive scan of all open ports and enumerate SMB shares
Why it's wrong here
This option is incorrect because the Nmap command does not include the -A flag, which is necessary to enable aggressive scan mode, encompassing OS detection, version detection, script scanning, and traceroute. Furthermore, the command explicitly targets only four specific ports (22, 80, 443, 3389), not 'all open ports.' Crucially, enumerating SMB shares requires dedicated Nmap Scripting Engine (NSE) scripts, such as --script smb-enum-shares, and typically targets port 445, which is not included in the specified port list.
✓
Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting
Why this is correct
This statement accurately describes the Nmap command's functionality. The -sS flag initiates a TCP SYN scan, a common and relatively stealthy method for port scanning that avoids completing the full TCP handshake. The -sV flag enables service version detection, attempting to determine the exact software and version running on open TCP ports. Additionally, the -O flag instructs Nmap to attempt OS fingerprinting, identifying the target's operating system. Finally, the -p 22,80,443,3389 option restricts the scan to precisely these four specified TCP ports.
✗
Perform a full TCP connect scan with UDP service detection on all ports
Why it's wrong here
This option is incorrect due to several misinterpretations of the Nmap command. The -sS flag performs a TCP SYN scan, which is distinct from a full TCP connect scan (-sT) as it does not complete the three-way handshake. Furthermore, while -sV detects service versions, it applies to TCP services, not UDP services; UDP service detection would require the -sU flag. Lastly, the command explicitly targets only four specific ports (22, 80, 443, 3389), not 'all ports' on the target system.

Visual reference

Go deeper

CEH Footprinting, Reconnaissance and Scanning Practice Question

Why each option matters

Option-by-option breakdown

Related to this question