CCNA Scanning and Mapping Questions

The -sn option performs host discovery only and skips port scanning, and Nmap's default discovery probes include TCP SYN to port 443 and TCP ACK to port 80 in addition to ICMP, so hosts that block ping but expose web services are still detected. This satisfies both the discovery-only and ICMP-blocked requirements.

To quickly identify live hosts without port scanning, the -sn option is used. It performs host discovery using a combination of ICMP, TCP, and UDP probes, but does not scan ports. This is the standard Nmap command for ping sweeps, making it the correct answer for this scenario.

ICMP-based discovery, such as a ping sweep, identifies hosts by simply checking for responses to 'echo requests'. Because this avoids the transport layer (TCP/UDP) entirely, it is a low-impact and highly efficient way to map network topology. This is vital when the responder must map a large environment quickly without generating connection-based logs on the target systems or intermediary security devices.

The traffic pattern of TCP SYN packets sent to sequential ports on multiple hosts is the hallmark of a TCP SYN scan, which is the default and most common Nmap scan type. It is stealthy because it never completes the three-way handshake, reducing the chance of being logged by applications. The other scan types either use different flags (FIN), different protocols (UDP), or complete connections (connect scan), making them inconsistent with the observed SYN-only traffic.

When ICMP is blocked, using TCP-based host discovery can improve results. The -PS option sends TCP SYN packets to specified ports, and a response (SYN/ACK or RST) indicates the host is up. This method is more likely to succeed through firewalls that allow TCP traffic, making it the correct answer.

An Nmap SYN scan (-sS) sends a TCP SYN packet and waits for a response. If the target service is listening, it responds with a SYN-ACK packet. Upon receiving the SYN-ACK, Nmap immediately transmits a RST packet to tear down the connection before the operating system kernel can complete the standard three-way handshake, preserving stealth and speed.

Randomizing scan targets is a defensive measure against triggering automated threshold-based IDS/IPS alerts. By jumping between different subnets, the scanner avoids concentrating traffic on a single point in the network, which effectively prevents the security system from correlating multiple hits on a single host or subnet, thereby keeping the responder's reconnaissance activity below the typical detection thresholds of the organization.

The --reason flag provides deep visibility into why Nmap labeled a port in a specific way by reporting the exact packet or ICMP message that caused the determination. This is incredibly useful for incident responders, as it allows them to identify exactly which network devices (like a firewall or a specific host OS behavior) are causing traffic to be filtered or dropped during an assessment.

The IP protocol scan (-sO) is specifically designed to determine which IP protocols are supported by a target. It sends IP packets with different protocol numbers and analyzes the responses (or lack thereof) to identify supported protocols. This makes it the correct choice for the scenario.

Validating a perimeter ruleset for both protocols requires a TCP scan and a UDP scan. The TCP SYN scan is the standard, efficient way to determine which TCP ports the firewall permits, while the UDP scan is the only Nmap technique that probes UDP ports and interprets ICMP unreachable responses or service replies to classify them. Together they cover the TCP and UDP rule sets the team wants to verify.

Nmap's scripting engine (NSE) provides dedicated scripts like 'smb-vuln*' that can scan for specific vulnerabilities such as MS17-010. By integrating these scripts directly into the scanning workflow, responders can quickly map the attack surface and identify high-value targets for lateral movement without switching tools, ensuring a cohesive and efficient assessment of the environment's configuration security.

Using native tools like PowerShell or Netcat allows for basic network verification when dedicated scanning tools are blocked by endpoint security suites. By leveraging built-in functionality such as Test-NetConnection in PowerShell, a responder can verify reachability and port status without introducing unauthorized binaries, thereby maintaining the integrity of the environment while still performing necessary incident response data gathering.

An ACK scan sends packets with only the ACK flag set, which bypasses stateless or simple stateful firewalls that only track initial connection attempts. However, because an ACK packet is sent to an established connection, any port that is open or closed will reply with a RST packet. This behavior prevents the analyst from distinguishing between open and closed ports, making it useful solely for determining if a port is filtered by a firewall.

The -O flag instructs Nmap to perform TCP/IP stack fingerprinting, which analyzes specific behaviors of the target's networking stack. This is vital for responders to classify assets, identify potential legacy systems, and determine if the target matches known vulnerable OS versions during the scoping phase of an incident investigation or routine security audit.

The --source-port flag allows for the manipulation of the packet's source port, which is a common technique for bypassing firewall rules configured to permit traffic from trusted services like DNS. This is useful for responders trying to map networks where basic ingress/egress filtering is in place, as it mimics expected protocol behavior to slip through simple security controls.

Adding --reason to an Nmap scan causes each port entry to include the reason Nmap assigned the state, such as syn-ack for open, reset for closed, or no-response for filtered. This distinction is critical in a DMZ where a drop and a reset imply very different firewall or host behaviors, and it gives the responder defensible evidence for the report.

Aggressive timing templates rely on short timeouts, expecting quick responses from targets. In high-latency networks, these short timeouts lead to false negatives, where Nmap incorrectly labels a port as 'filtered' simply because the response did not arrive before the aggressive timer expired. This leads to inaccurate mapping and missed vulnerabilities, directly undermining the goals of the incident investigation.

The -sn ping scan performs host discovery without port scanning and uses multiple probe types, including TCP SYN to port 443 and TCP ACK to port 80, so it can identify live hosts even when ICMP is blocked. This makes it the correct lightweight liveness check before committing to a full port scan. The other options either skip discovery, perform a port scan, or perform OS fingerprinting, all of which are heavier or not designed for simple liveness detection.

Industrial control systems (ICS) and legacy devices are often highly sensitive to high-traffic volumes. Using T0 (paranoid) or T1 (sneaky) ensures that packets are sent at a slow rate, giving these devices sufficient time to process requests. This minimizes the risk of a buffer overflow or service crash that could result from overwhelming the device's limited computational resources with modern scanning speeds.