CEH Footprinting, Reconnaissance and Scanning Practice Question
A penetration tester wants to perform a ping sweep on a /24 subnet to identify live hosts. Which command would accomplish this efficiently?
⚠ Common exam trap
Many exam-takers confuse `-sn` (ping sweep) with `-sP` (deprecated alias) or assume that `-O` or `-sV` are faster because they provide more information, but they actually add significant overhead and are not designed for simple host discovery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
nmap -sn 192.168.1.0/24
`nmap -sn` performs a ping sweep (host discovery) without port scanning, sending ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default. This efficiently identifies live hosts on a /24 subnet without the overhead of port scanning or OS detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
nmap -sn 192.168.1.0/24
Why this is correct
The `nmap -sn 192.168.1.0/24` command is the correct choice for performing a ping sweep, also known as host discovery. The `-sn` (or `--ping-scan`) flag instructs Nmap to skip port scanning and only attempt to determine if hosts are online. It achieves this by sending a combination of ICMP echo requests, TCP SYN packets to port 443, and TCP ACK packets to port 80, along with an ICMP timestamp request, to identify live hosts efficiently across the specified /24 subnet. This method quickly identifies active devices without generating extensive network traffic from full port scans.
- ✗
nmap -O 192.168.1.0/24
Why it's wrong here
The `nmap -O 192.168.1.0/24` command is designed for operating system detection, not for a simple ping sweep. The `-O` flag enables Nmap's OS fingerprinting capabilities, which involve sending a series of specialized TCP and UDP packets to open and closed ports, then analyzing the responses to infer the target's operating system and device type. This process is significantly more intrusive and time-consuming than merely identifying live hosts, as it requires prior port scanning to function effectively.
- ✗
nmap -p- 192.168.1.0/24
Why it's wrong here
Using `nmap -p- 192.168.1.0/24` would initiate a comprehensive port scan across all 65,535 TCP ports for every host within the 192.168.1.0/24 subnet. This command is extremely resource-intensive and time-consuming, as it attempts to establish connections or send SYN packets to every possible TCP port on each potential target. While it would eventually reveal live hosts by identifying open ports, its primary purpose is exhaustive port enumeration, not the quick and efficient host discovery characteristic of a ping sweep.
- ✗
nmap -sV 192.168.1.0/24
Why it's wrong here
The `nmap -sV 192.168.1.0/24` command is used for service and version detection on open ports. This flag instructs Nmap to probe identified open ports with various payloads to determine the specific application and its version running on that port (e.g., Apache HTTP Server 2.4.x, OpenSSH 8.x). Version detection is a post-port-scanning activity and does not perform the initial host discovery or ping sweep itself; it relies on previously discovered open ports to function.
Visual reference
Go deeper
Related to this question
Learn chapter
Scanning Networks
Key term
Nmap Scanning
Nmap scanning is a method used to discover devices running on a network and find open ports, services, and security weaknesses.
Key term
Active reconnaissance
Active reconnaissance is the process of directly interacting with a target system or network to gather information, often through scanning and probing.
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.