CEH Footprinting, Reconnaissance and Scanning Practice Question
During a penetration test, you need to identify all live hosts on a target network without being detected by intrusion detection systems. Which Nmap flag would BEST achieve this?
⚠ Common exam trap
It's easy for candidates to confuse -sn (ping sweep) with -sS (SYN scan) because both involve TCP packets, but -sn is purely for host discovery without port scanning, whereas -sS is a port scanning technique that is much more intrusive and detectable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
-sn (ping sweep)
The -sn flag (ping sweep) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default to determine if a host is alive. This is the best choice for stealthy host discovery because it does not complete a full TCP handshake or send application-layer probes, minimizing the chance of triggering IDS signatures that look for port scans or OS fingerprinting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
-O (OS fingerprinting)
Why it's wrong here
OS fingerprinting, initiated by the -O flag, involves sending a series of specialized TCP and UDP probes to open ports to deduce the target's operating system. This process generates significant network traffic and requires active interaction with the target's services, making it easily detectable by Intrusion Detection Systems (IDS) and unsuitable for merely identifying if a host is live without revealing reconnaissance activity.
- ✓
-sn (ping sweep)
Why this is correct
The -sn (no port scan) flag, also known as a ping sweep, is specifically designed for host discovery by sending ICMP echo requests, TCP SYN packets to common ports, or ARP requests on local networks. It efficiently identifies live hosts with minimal network overhead and without initiating any full port scans, thereby significantly reducing the likelihood of detection by network security monitoring tools.
- ✗
-sS (SYN scan)
Why it's wrong here
A SYN scan, invoked with the -sS flag, is a half-open port scanning technique that sends SYN packets and waits for SYN/ACK responses to determine open ports. While stealthier than a full TCP connect scan, it still actively probes individual ports across a target range, generating more suspicious traffic than a simple host discovery method and increasing the risk of triggering port scan detection mechanisms.
- ✗
-sV (version detection)
Why it's wrong here
The -sV flag enables service version detection, which actively probes open ports to identify the specific application and its version running on the service. This process involves establishing full connections and exchanging application-layer data, making it a highly intrusive and noisy operation that is far too aggressive for initial host identification and almost guaranteed to trigger security alerts.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.