GCIH Scanning and Mapping Practice Question
A responder is scanning a target host and wants to determine which IP protocols (e.g., ICMP, IGMP, TCP) are supported by the target. Which Nmap scan type should be used?
⚠ Common exam trap
The trap here is assuming that TCP or UDP scans can reveal all IP protocols, but they only cover TCP and UDP respectively.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IP protocol scan (-sO)
The IP protocol scan (-sO) is specifically designed to determine which IP protocols are supported by a target. It sends IP packets with different protocol numbers and analyzes the responses (or lack thereof) to identify supported protocols. This makes it the correct choice for the scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ping scan (-sn)
Why it's wrong here
The -sn scan is used for host discovery only; it does not scan ports or IP protocols. It sends a few probes to determine if a host is up but does not enumerate supported IP protocols. Therefore, it cannot fulfill the requirement of identifying which IP protocols the target supports.
- ✗
TCP SYN scan (-sS)
Why it's wrong here
The -sS scan is used to identify open TCP ports by sending SYN packets and analyzing responses. It does not probe IP protocols other than TCP, so it cannot determine which other IP protocols the target supports. This scan is limited to TCP port discovery.
- ✗
UDP scan (-sU)
Why it's wrong here
The -sU scan probes UDP ports to identify open UDP services. While UDP is an IP protocol, this scan only tests UDP, not other protocols like ICMP or IGMP. It does not provide a comprehensive view of supported IP protocols, so it is not the correct choice.
- ✓
IP protocol scan (-sO)
Why this is correct
The -sO scan sends IP packets with various protocol numbers in the IP header to determine which IP protocols are supported by the target. It can identify support for protocols such as ICMP, IGMP, TCP, UDP, and others. This is the correct scan type for enumerating supported IP protocols.
About these practice questions
This GCIH question is part of Courseiva's 322-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCIH practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCIH exam.