Decoding Nmap Command: -sS -sV -O -p
A security analyst runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?
Quick Answer
The correct answer is that this Nmap command performs a TCP SYN scan on four ports, detects service versions, and attempts OS fingerprinting. This is because the `-sS` flag initiates a stealth half-open scan that never completes the TCP handshake, `-sV` probes open ports to identify running application versions, and `-O` sends a series of probes to guess the target operating system; the `-p` option limits the scan to ports 22, 80, 443, and 3389, while the `/24` subnet targets all 256 hosts in the 192.168.1.0 range. On the CEH exam, this combination tests your ability to read multi-flag Nmap syntax and understand how each flag modifies scan behavior—a common trap is confusing `-sS` with a full connect scan (`-sT`) or forgetting that `-O` requires root privileges for accurate results. To remember the flags, think “SSVO” as “Stealth, Service, Version, OS”—each letter maps directly to the scan’s purpose.
⚠ Common exam trap
Many exam-takers confuse `-sS` (SYN scan) with a full connect scan (`-sT`) or mistakenly think `-sV` and `-O` imply an aggressive scan (`-A`), which also includes default scripts and traceroute.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting
The `-sS` flag initiates a TCP SYN stealth scan, `-sV` enables service version detection, and `-O` attempts OS fingerprinting. The `-p 22,80,443,3389` limits the scan to those four ports, and the target `192.168.1.0/24` scans the entire Class C subnet. This combination performs a half-open scan on the specified ports, probes for application versions, and tries to identify the operating system of each live host.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perform a full TCP connect scan with UDP service detection on all ports
Why it's wrong here
-sS is a SYN scan, not a full connect scan. -sV detects TCP service versions, not UDP. Not all ports are specified.
- ✓
Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting
Why this is correct
-sS = SYN/stealth scan, -sV = version detection, -O = OS fingerprinting, -p 22,80,443,3389 = scan only these four ports. This is a targeted reconnaissance scan.
- ✗
Perform an aggressive scan of all open ports and enumerate SMB shares
Why it's wrong here
The -A flag enables aggressive mode (not used here). SMB enumeration requires specific scripts (--script smb-enum-shares). The specified ports do not include 445.
- ✗
Perform a UDP scan on the four specified ports and identify running services
Why it's wrong here
-sS is a TCP SYN scan, not a UDP scan. UDP scanning requires the -sU flag.
Visual reference
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?
medium- A.Perform an aggressive scan of all open ports and enumerate SMB shares
- ✓ B.Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting
- C.Perform a UDP scan on the four specified ports and identify running services
- D.Perform a full TCP connect scan with UDP service detection on all ports
Why B: The command `nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24` performs a TCP SYN scan (`-sS`) on only the four specified ports, enables service version detection (`-sV`), and attempts OS fingerprinting (`-O`). This is a stealthy half-open scan that does not complete the TCP three-way handshake, combined with banner grabbing and OS detection, limited to the given port list.
Variation 2. A penetration tester runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?
medium- A.Perform a UDP scan on the four specified ports and identify running services
- B.Perform an aggressive scan of all open ports and enumerate SMB shares
- ✓ C.Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting
- D.Perform a full TCP connect scan with UDP service detection on all ports
Why C: The command uses the -sS flag for a TCP SYN scan (stealth scan), -sV for service version detection, and -O for OS fingerprinting, targeting only the four specified ports (22, 80, 443, 3389) across the 192.168.1.0/24 subnet. This combination performs a half-open TCP scan on those ports, probes open ports to identify service versions, and attempts to determine the operating system based on TCP/IP stack responses.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.