GCIH Scanning and Mapping Practice Question
A responder is performing a vulnerability scan on a segment containing industrial control systems. Which Nmap timing template should be used to avoid disrupting sensitive, potentially fragile hardware?
⚠ Common exam trap
Candidates often select the default or faster timing templates (like T3 or T4) to save time, ignoring the fact that legacy or sensitive ICS hardware can crash under the stress of rapid scanning.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
T0
Industrial control systems (ICS) and legacy devices are often highly sensitive to high-traffic volumes. Using T0 (paranoid) or T1 (sneaky) ensures that packets are sent at a slow rate, giving these devices sufficient time to process requests. This minimizes the risk of a buffer overflow or service crash that could result from overwhelming the device's limited computational resources with modern scanning speeds.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
T0
Why this is correct
T0 is the most cautious timing template, sending packets with a very long delay between them. This approach is ideal for critical or fragile environments where even minor network overhead could cause a system failure, ensuring that the scanning process does not disrupt the availability of time-sensitive and mission-critical hardware systems.
- ✗
T3
Why it's wrong here
T3 is the default timing template and is generally too aggressive for sensitive industrial control systems. It assumes a modern, robust network infrastructure where traffic density is not an issue. Using this template in fragile environments risks overwhelming legacy stacks, potentially leading to system instability, service denial, or unexpected device reboots.
- ✗
T4
Why it's wrong here
T4 is an aggressive template designed for fast networks and stable hardware. It prioritizes speed over caution and will frequently crash or hang sensitive devices that lack the processing power to handle concurrent packet streams, making it completely unsuitable for environments containing legacy or specialized industrial control equipment during an assessment.
- ✗
T5
Why it's wrong here
T5 is the fastest, most aggressive timing template available. It is intended for use only on high-speed, reliable networks where speed is the primary constraint. Using T5 against fragile or industrial systems is essentially guaranteed to cause service disruptions, as the sheer volume of packets will overwhelm the target's networking capabilities.
About these practice questions
One of 322 original GCIH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCIH practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCIH exam.