GPEN Scanning and Host Discovery Practice Question
You are performing a penetration test against a web server and want to identify the exact version of the HTTP service running on port 80. Which Nmap command should you use?
⚠ Common exam trap
Many exam-takers confuse OS detection or port state scanning with service version detection, which specifically identifies application software and versions on open ports.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
nmap -sV -p 80 <target>
Service version detection with -sV is the correct technique to identify the software and version running on an open port. It sends probes and compares responses against a signature database, providing the HTTP server version needed for further vulnerability assessment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
nmap -sS -p 80 <target>
Why it's wrong here
A SYN scan only determines whether port 80 is open, closed, or filtered. It does not interact with the service to extract banner or version information. While it is a fast way to confirm the port is listening, it provides no detail about the HTTP server software or version, which is the goal here.
- ✓
nmap -sV -p 80 <target>
Why this is correct
The -sV option enables service version detection, which probes the open port and analyzes the responses to identify the application name, version, and sometimes additional details. Combined with -p 80, it targets the HTTP service specifically, making it the correct choice for identifying the web server version.
- ✗
nmap -sn -p 80 <target>
Why it's wrong here
The -sn option disables port scanning and is used only for host discovery. Adding -p 80 has no effect because no ports are scanned. This command would only tell you if the host is up, not what service or version is running on port 80, so it fails to meet the requirement.
- ✗
nmap -O -p 80 <target>
Why it's wrong here
The -O option enables operating system detection, which attempts to identify the target's OS, not the version of the HTTP service. While useful for fingerprinting the host, it does not provide application-level version details for port 80. It is the wrong tool for identifying the web server software version.
About these practice questions
Courseiva writes every GPEN question from scratch — 298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GPEN practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GPEN exam.