GPEN Scanning and Host Discovery Practice Question
During an internal penetration test you need to enumerate live hosts on a /24 subnet that you suspect is protected by a stateful firewall dropping ICMP echo requests. You want the scan to be fast and you have administrative (root) privileges on your Kali system. Which Nmap command best accomplishes host discovery in this scenario?
⚠ Common exam trap
The trap here is assuming that a ping sweep must use ICMP, when a TCP SYN ping to an open service port is often the reliable discovery method on filtered networks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
nmap -sn -PS22,80,443 10.10.10.0/24
A TCP SYN ping to a commonly open port works even when ICMP is filtered because the firewall permits the TCP handshake to legitimate services. Combining -PS with -sn keeps the scan focused on discovery, making it fast and effective against a stateful firewall that drops echo requests.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
nmap -sn -PS22,80,443 10.10.10.0/24
Why this is correct
With root privileges, a TCP SYN ping (-PS) to commonly open ports such as 22, 80, and 443 will elicit a SYN/ACK or RST from live hosts even when ICMP is filtered, and -sn disables port scanning so the run stays fast. This directly addresses the firewall that drops echo requests.
- ✗
nmap -sn -PE 10.10.10.0/24
Why it's wrong here
The -PE option sends only ICMP echo requests. Because the scenario states the firewall is dropping ICMP echo requests, this scan will report most or all live hosts as down, producing a false negative result. It does not use a TCP-based probe to bypass the filtered ICMP path.
- ✗
nmap -sn -PR 10.10.10.0/24
Why it's wrong here
The -PR option performs an ARP ping, which only works on the local layer-2 broadcast domain. If the /24 is reachable through a router or on a remote segment, ARP requests will not cross the boundary, so this would miss hosts. It also does not help when the target is not locally attached.
- ✗
nmap -sS -p 1-1024 10.10.10.0/24
Why it's wrong here
This performs a full SYN scan of the first 1024 ports on every host, which is slow and unnecessary when the goal is simply host discovery. It also generates far more traffic and IDS/IPS alerts than a targeted ping sweep, defeating the requirement for a fast discovery scan.
Visual reference
About these practice questions
This GPEN question is part of Courseiva's 298-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GPEN practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GPEN exam.