Exam 200-201 topic 1 question 78 discussion

Correct answer is C. nmap -sL 192.168.1.0/24 https://nmap.org/book/host-discovery-controls.html https://nmap.org/book/man-briefoptions.html -sL: List Scan - simply list targets to sca

Nmap -sP 192.168.1.0/24 This command will perform a simple ping scan to identify hosts that are alive in the specified IP range without performing a detailed port scan, which is less likely to trigger intrusive alerts on IDS devices.

The best answer is B. The engineer needs to discover alive hosts within the 192.168.1.0/24 range without triggering intrusive portscan alerts on the IDS device using Nmap. The --sP option in Nmap sends an ICMP echo request, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp request probes to determine if a host is up. This is a non-intrusive method of host discovery and does not send any probes to specific ports that could trigger alerts on an IDS device. Option A (--top-ports) is used to scan the top N most frequently used ports on a host, and is not used for host discovery. Option C (-sL) sends a list scan and does not send any probes to determine if a host is up. This option simply lists the targets that would be scanned by Nmap. Option D (-sV) is used for version detection and does not send any probes to determine if a host is up.

The "-sP" option instructs Nmap to perform a simple ping scan to determine which hosts are alive on the network. This type of scan does not send any packets to the target hosts' ports, so it should not trigger any intrusive portscan alerts on the IDS device. The output of this command will list the IP addresses of the live hosts found on the network.

-sn (No port scan) This option tells Nmap not to do a port scan after host discovery, and only print out the available hosts that responded to the host discovery probes. In previous releases of Nmap, -sn was known as -sP.

I think the answer is B from what I read in all the links below.

The answer is B. The -sP option skips port scanning and checks for live hosts in the network. See this link https://www.golinuxcloud.com/nmap-command-in-linux/#:~:text=nmap%20command%20allows%20you%20to%20scan%20a%20system,by%20using%20an%20IP%20address%20with%20nmap%20command.

B is correct -sP allows light reconnaissance of a target network without attracting much attention. Knowing how many hosts are up is more valuable to attackers than the list provided by list scan of every single IP and host name.

B is correct. Supported here. https://linuxhint.com/nmap_ping_sweep/

-sP solo realizar ping (igual que con –PP –PM –PS443 –PA80), descubriendo así los host vivos de la red sin escaneo de puertos, tal y como dice la pregunta.

-sL (List Scan) The list scan is a degenerate form of host discovery that simply lists each host of the network(s) specified, without sending any packets to the target hosts. By default, Nmap still does reverse-DNS resolution on the hosts to learn their names. It is often surprising how much useful information simple hostnames give out. -sn (No port scan) This option tells Nmap not to do a port scan after host discovery, and only print out the available hosts that responded to the host discovery probes. This is often known as a “ping scan”, but you can also request that traceroute and NSE host scripts be run. This is by default one step more intrusive than the list scan, and can often be used for the same purposes. It allows light reconnaissance of a target network WITHOUT ATTRACTING MUCH ATTENTION. Knowing how many hosts are up is more valuable to attackers than the list provided by list scan of every single IP and host name. IN PREVIOUS RELEASES OF NMAP, -sn WAS KNOWN AS -sP. Correct answer is B Source: https://nmap.org/book/man-host-discovery.html

B is correct: https://explainshell.com/explain?cmd=nmap+-sP

ans should be C

from NMAP Cheat Sheet -sn: Probe only (host discovery, not port scan) -sS: SYN Scan -sT: TCP Connect Scan -sU: UDP Scan -sV: Version Scan -O: Used for OS Detection/fingerprinting --scanflags: Sets custom list of TCP using URG ACK PSH RST SYN FIN in any order

nmap 192.168.1.1-3 -sL No Scan. List targets only nmap 192.168.1.1/24 -sn Disable port scanning. Host discovery only. So -Sn is the correct answer seeing the question is asking about alive hosts.

The -sP is the ping sweep, this parameter don't make a port scanning. Try by your self on your network.

The -sL list scan still scans the listed targets. Though not given an an answer choice, the -sn options causes nmap to ping sweep only without any port scanning.