Nmap/ZenMap Switches Practice Test

These questions are part of the practice quiz. Start practicing

• What is the effect of --top-ports 100 in an Nmap scan?
• What is the difference between -S (spoof source IP) and --source-port, and when would you use each?
• What does the -sV option do in Nmap?
• Which statement best describes the relationship between -A and OS detection (-O)?
• Which port state means Nmap cannot determine whether a port is open or filtered, typically for UDP, IP protocol, FIN, NULL, and Xmas scans?
• What is required to scan both UDP and TCP ports?
• Which port state indicates the port is being blocked or not reachable due to packet filtering, and probes do not reach the port?
• Which option would you use to perform a UDP scan?
• How would you run a script-based vulnerability check on a target using NSE's vuln category, and what considerations apply?
• How does --version-intensity affect version detection (and when would you adjust it)?
• Which port state indicates the port is accessible and responds to probes, but there is no application listening on it?
• Which option would you use to perform service version detection on a target?
• Which option makes scans originate from spoofed IP addresses?
• What is the purpose of the --top-ports option and how would you scan the top 50 ports?
• Which option writes scan results in Normal Output format?
• What is the purpose of the --script-args option when running NSE scripts?
• Which timing template corresponds to the default 'Parallel, normal speed scan' when no speed is assigned?
• How does a SYN stealth scan (-sS) differ from a TCP connect scan (-sT) in terms of connection behavior and detectability?
• Which tool is described as a passive fingerprinting tool not used in Nmap?
• DNS Scan aka List Scan: Which scan is used to list IPs for all listed subnets on the command line?
• When would you use -sC versus -sV and -A, and what does the -A option enable?
• Which NSE script category would you specify to perform a broad vulnerability check?
• Which option performs a TCP SYN Ping to ports 100 and 90?
• Which statement about an ACK scan (-sA) is true?
• Which statement about the -oA output is correct?
• What is the effect of --min-rate and --max-rate on scan throughput, and why would you adjust them?
• Why does using the -n option speed up Nmap scans?
• Which statement describes the effect of the -Pn option on Nmap scans?
• Which flag would you use to perform a comprehensive scan including OS detection, script scanning, version detection, and traceroute?
• How can you specify both TCP and UDP ports in a single -p specification, and what would an example look like?
• Which option enables traceroute information in scan results?
• What data does Nmap typically report after OS fingerprinting?
• Which flags are generally required to spoof a scan so the targets believe someone else is scanning?
• Which command line includes both a TCP connect scan and operating system detection?
• Which option instructs Nmap version detection to consider all ports during detection?
• Which flag would you use to perform operating system detection via TCP/IP fingerprinting?
• How do you interpret NSE script results in the scan output and what should you do if scripts fail due to privileges?
• What is the general effect of using a higher timing template on a scan?
• In Zenmap, what is a Profile and how does it relate to repeatable scans?
• What is the -oG output format primarily used for?
• If an application is actively accepting TCP connections on a port, what is the likely port state?
• Which utility sends ICMP packets to a host?
• Which is the correct syntax to scan ports in a range from 1 to 20?
• Which option initiates a UDP scan?
• Which statement about running an aggressive scan with -A on a sensitive network is true?
• What are the scan types -sN, -sF, and -sX, and when might you use each?
• What is a typical use case for Nmap XML output in security workflows?
• What does the --max-retries option do, and how does adjusting it affect scan reliability and duration?
• Idle scan relies on which side-channel to infer port states?
• Which option specifies a TCP Ping to ports 100 and 90?
• In addition to network load, what is another reason to adjust --min-rate and --max-rate?
• Which option controls port scanning in Nmap?
• How would you use Zenmap to compare two scans and identify differences in hosts or services?
• How can you pass arguments to NSE scripts via --script-args, with an example?
• Which switch instructs Nmap to examine the 100 most commonly used ports for speed?
• Explain the use of --min-hostgroup and --max-hostgroup and how they affect parallel host scanning.
• In older versions of Nmap, which flag was used to disable host discovery?
• Which option excludes specific IPs or ranges from the scan?
• Null Scan: Which scan sends a packet with no flags set?
• What is the effect of the -R option and when would you want to use it?
• What does the -A option do in Nmap and what are the risks of using it on sensitive networks?
• What is the primary difference between a SYN scan (-sS) and a TCP connect scan (-sT), and when would you choose one over the other?
• Which command demonstrates inspecting versions only on port 80 and 443?
• Which option implements a traceroute to target hosts?
• Which statement best describes Idle scan (-sI) and its prerequisites/risks?
• What does the -oA option do?
• Which statement describes why a UDP scan can show open|filtered results?
• How does a UDP scan (-sU) operate and why are UDP results often incomplete compared to TCP scans?
• How do you feed Nmap with a list of targets using -iL, and what advantages does it provide?
• Which scan type performs a TCP three-way handshake?
• Which option enables operating system detection in an Nmap scan?
• Which statement best describes UDP scanning relative to TCP scanning?
• Which of the following correctly pairs an NSE script category with a typical use?
• Which switch enables version detection to determine the service running on a port?
• What is --data-length used for, and when would you apply it?
• Which combination is commonly used to enable traceroute alongside broader discovery features?
• Which switch tells Nmap to scan all possible ports from 1 to 65535?
• Which option sets the source IP address used for outgoing packets in Nmap?
• Which combination helps reproduce results across environments?
• If an NSE script times out, what happens to the script and the scan?
• Why is it important to obtain permission and verify policy compliance before running vulnerability scans?
• Which statement best describes an intrusive NSE script?
• Which timing template corresponds to Paranoid (0) IDS evasion?
• Which statement correctly describes the relationship between -sV and --version-intensity 0 vs 9?
• What is the purpose of the -oA option in Nmap?
• What is the purpose of the -sA option and what does an ACK scan reveal about firewall behavior?
• How would you validate a vulnerability found by an NSE script in a controlled environment, and what precautions should you take?
• Why might OS detection (-O) require elevated privileges, and what are the implications?
• Which scan uses FIN, PSH, and URG flags for probing and is known as a Fin scan?
• Which scan type is referred to as Windows Scan?
• The --open option shows which port states?
• Which flag enables IPv6 scanning, and what is a correct example of its usage?
• What is the purpose of the -sV switch in Nmap, and what kind of data does it attempt to extract from open ports?
• Which Nmap timing template corresponds to aggressive speed suitable for fast networks?
• As of the described installation, how many NSE scripts are available?
• Idle Scan uses which initial TCP flag?
• What does the --traceroute option do and what information does it provide?
• Which option performs an ARP Ping?
• Which statement about -oA is incorrect?
• Which statement about idle (s0) scan is true?
• What does the -A option enable in Nmap?
• What determines the type of scan to perform?
• Which flag allows version detection to consider all ports during scanning?
• What is the purpose of the -O option, and how does it complement -sV?
• Compare the scanning techniques -sN, -sF, and -sX in terms of the TCP flags they send and the typical OS behavior they exploit.
• How can you identify which NSE scripts require elevated privileges or may be unsafe to run in production?
• Which timing template is labeled Insane (5) speed in Nmap?
• Which statement about the -sV option is true?
• Which option allows you to adjust the version detection intensity with a specific parameter?
• Which option enables operating system detection in Nmap?
• How are NSE script arguments passed and what is the general syntax for --script-args?
• Which timing template corresponds to the Polite (2) that slows down the scan to use less bandwidth and resources?
• How can you disable DNS resolution and why would you do this on large networks?
• What does the --reason option do and why would you enable it?
• TCP Xmas Tree Scan: Which scan sends the FIN, PSH, and URG flags to resemble a Christmas tree?
• What precautions should you take when validating an NSE script vulnerability in a controlled environment?
• How can you specify a custom network interface to use for scanning and which option achieves this?
• How can you enumerate SMB shares using an NSE script, and what is the script name?
• What is the purpose of the --badsum option and when would you use it?
• Which option is used to scan UDP ports?
• What does the -T2 (Polite) timing template do?
• What is the purpose of the -e option and the -S/--source-address options, and when would you use them?
• Which option outputs results in the normal (default) format?
• Which timing template represents a parallel, normal-speed scan?
• How can you run Nmap to scan the most common 100 ports across a list of hosts provided in a file, and save all outputs?
• Which option writes scan results in XML Output format?
• How can you control the rate of packets sent with --min-rate and --max-rate, and why would you adjust it?
• How do you specify a source port with -g or --source-port, and why might it be useful?
• The --traceroute feature provides information about what aspect of the network?
• Which scan type is described as SYN/Stealth/Half Open Scan, with an initial SYN flag?
• When would you use -Pn (no ping) and what is the trade-off?
• How does the -v option affect output, and what does -vv add?
• Which timing template corresponds to the Paranoid (0) IDS evasion level?
• What does the -n option do in Nmap?
• Idle Scan: Which scan uses a zombie host and relies on IPID behavior?
• What is the purpose of -oG and how can you parse its output to extract open ports?
• How can you balance speed and stealth by combining timing templates with rate limiting?
• What is one risk or consideration of idle scans?
• What is the purpose of the -D decoy option, and what are potential caveats?
• Compared to idle scans, standard scans are described as
• Which option performs a UDP Ping to ports 100 and 90?
• Which option selects a lighter version scanning mode via an alias for a specific intensity?
• If you want to scan only ports 22 and 3389, which -p syntax would you use?
• Which syntax scans ports that are in the nmap-services list below a threshold?
• How does IPv6 scanning interact with the -6 option and what should you be aware of when scanning IPv6 networks?
• When is it generally inadvisable to use the most aggressive timing template?
• How can you reuse a saved scan profile in Zenmap to ensure reproducibility across environments?
• Which two flags were used in previous versions to indicate no host discovery?
• What outputs do -oN, -oX, -oG, and -oA produce, and how would you save all formats with a single base filename?
• Which statement best describes idle scans in Nmap?
• What does the -O switch do and what are its typical limitations?
• If you want to run only discovery NSE scripts, which flag would you use?
• Which Nmap option disables port scanning while still performing host discovery and prints only hosts that responded?
• What does the version intensity option control in Nmap?
• What is the practical use of grepable output (-oG) from a scan?
• Which option enables OS detection, version detection, script scanning, and traceroute in a single scan?
• How do you invoke NSE scripts from the command line and run a category like http-*?
• Which flag controls output to XML, normal, etc?
• In the given material, which tool is described as a passive fingerprinting utility outside of Nmap?
• How does --version-intensity affect version detection and when would you adjust it?
• Which Nmap scan type is used for a Ping Scan?
• How would you limit version detection to a subset of ports?
• How can you increase NSE's depth of version detection for more aggressive probing, and what is the corresponding option?
• Which option enables remote OS detection using TCP/IP stack fingerprinting?
• How would you run a scan that outputs to multiple formats and to a file on disk using -oA with a specific base name?
• How would you parse an Nmap XML output programmatically, and what is a typical use case?
• Which option filters results to show only ports that are open (or possibly open)?
• What is an idle (s0) scan and how does -sI <zombie> work?
• Which scan type scans UDP ports?
• Which statement about the -sC option is true?
• Which scan type is used to determine whether a host is protected by some kind of filtering system and uses ACK packets?
• How would you invoke NSE scripts for a specific category, and how would you run the default safe scripts only?
• How does -f fragmentation affect detection, and what risks does it carry?
• How is -A different from explicitly enabling -O, -sV, and NSE, and what are the risks of using -A?
• Which option performs a TCP connect scan?
• What does the -oA option do in an Nmap command?
• Define the standard port-state terms open, closed, filtered, unfiltered, and open|filtered as reported by Nmap.
• How does the -D option implement decoy scans and what effect does that have on the target's logs?
• Which timing template corresponds to the Polite (2) setting that slows the scan to use less bandwidth and resources?
• Which option performs an ICMP Ping?
• Which scan type corresponds to the RPC Scan?
• What is the effect of the -n option in Nmap, and when would you disable DNS resolution?
• To scan a single specified port, which Nmap option would you use?
• Which option allows you to specify NSE scripts by name or category on the Nmap command line?
• Why is traceroute information useful in scan results?
• What are the differences between -oN, -oX, -oG, and -oA output options in Nmap?
• Which syntax scans ports by protocol name such as http and ftp?
• What is a potential risk of OS detection requiring root privileges?
• The -iL option expects what kind of input?
• What is the meaning of Nmap's fingerprinting, and which options contribute to it (OS, service/version, NSE) and how do they complement each other?
• In UDP port scanning, what is the Open Response?
• Which of the following is a typical drawback of OS detection with -O?
• Distinguish between safe and intrusive NSE scripts and give an example usage scenario for each.
• Which option increases verbosity of the scan output?
• What does the --ttl option influence in Nmap scanning?
• How can you ensure reproducible results across repeated runs by using Nmap's and Zenmap's features?
• How do you scan a specific port range in Nmap, for example ports 80, 443, and 1024-1050?
• How does the --script-timeout option influence NSE script execution, and what happens if a script times out?
• In older Nmap releases, what was the equivalent flag for performing a host discovery without port scanning (-sn)?
• What is the meaning of a half-open SYN scan in practice?
• Which statement describes a risk associated with using -f fragmentation?
• Which option speeds up version scanning by using a lighter mode?
• Which timing template corresponds to Sneaky (1) IDS evasion?
• To scan both TCP and UDP ports in a single -p specification, which option is valid?
• What does the -sU option specify in Nmap?
• Which option differs from -sL by printing only hosts that responded to host discovery probes (no port scanning)?
• Which command initiates a UDP scan and targets UDP port 123?
• What is the initial action of a UDP port scan?
• Which Nmap scan type checks which IP protocols are supported on the target by sending raw IP packets?
• Which option yields a rapid scan of roughly the 100 most common ports, and how can you disable DNS resolution for speed?
• Which port state is used only for the IP ID idle scan where Nmap can't determine if closed or filtered?
• In UDP port scanning, what is the Filtered Response?
• If Nmap reports a host's port state as open, what does that imply, and how would you interpret closed and filtered states?
• Which option slash scanning times by avoiding DNS resolution?
• Which input method lets you feed Nmap a list of IPs, subnets, and hostnames one per line?
• Slower scans are less detectable?
• Which statement accurately describes the http-* category for NSE scripts?
• Which option allows Nmap to read targets from a file to scan?
• Which option enables UDP port scanning in Nmap, and what is a common drawback compared to TCP scanning?
• Which timing template corresponds to the Sneaky (1) IDS evasion level?
• What does the -f option do, and why would you fragment packets?
• Which option disables host discovery, performing a port scan only?
• Explain the timing templates -T0 to -T5 and the trade-offs between speed, stealth, and reliability.
• Can you combine -sS and -sU in a single Nmap command, and why would you do so?
• Which flag is used to run Nmap Scripting Engine (NSE) scripts?
• What does the -O option do in Nmap?
• Which scan type establishes a full three-way handshake (TCP Connect Scan)?
• Which timing template would you select if you want relatively fast but moderate detection risk?
• Which elements does Nmap use for OS fingerprinting, and what data is typically reported?
• How do you run a scan to display only open ports within a subset of ports (e.g., 80 and 443) using --open?
• Which option makes requested scans use tiny fragmented IP packets, helping evasion?
• How can you limit a scan's total time per host using --host-timeout, and why is this useful for large networks?
• What does the -Pn option do, and when would you use it?
• How can you save Nmap output in multiple formats in a single command, and which formats does -oA produce?
• Which command line fragment correctly scans the top ports across a target list and saves the output in all formats?
• What is the effect of the --open flag, and how does it influence the output?
• Which option enables a TCP ACK Ping to ports 100 and 90?
• In Zenmap, what is a profile and how do you use it to reproduce scans?
• In the context of idle scans, which statement best describes how it achieves stealth?
• Which port state means a port is accessible, but Nmap is unable to determine whether it is open or closed?