Port scanning with Nmap in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

📋 Factual

intermediate

What does the Nmap command nmap -sS 192.168.1.1 perform?

Choose the correct description of what the command nmap -sS 192.168.1.1 does.

Cybersecurity

nmap -sS 192.168.1.1

A Performs a TCP SYN scan to check open ports on the target IP 192.168.1.1

B Performs a UDP scan to check open UDP ports on the target IP 192.168.1.1

C Performs a full TCP connect scan on all ports of 192.168.1.1

D Performs a ping sweep to check if the host 192.168.1.1 is alive

💡 Hint

The -sS option is a common scan type in Nmap that uses a stealthy method.

The -sS option tells Nmap to perform a TCP SYN scan, which sends SYN packets to ports and waits for responses to determine if ports are open without completing the TCP handshake.

🧠 Conceptual

intermediate

Which Nmap option is used to scan only specific ports?

Identify the correct Nmap option to scan only ports 22, 80, and 443 on a target.

A -sP 22,80,443

B -p 22,80,443

C -T 22,80,443

D -oN 22,80,443

💡 Hint

Look for the option that specifies ports directly.

The -p option in Nmap allows you to specify which ports to scan by listing them separated by commas.

🔍 Analysis

advanced

What is the main difference between nmap -sS and nmap -sT scans?

Analyze the difference in behavior between the two scan types and select the correct statement.

A <code>-sS</code> scans all ports; <code>-sT</code> scans only top 1000 ports

B <code>-sS</code> scans UDP ports; <code>-sT</code> scans TCP ports

C <code>-sS</code> performs a ping scan; <code>-sT</code> performs a SYN scan

D <code>-sS</code> performs a stealthy SYN scan without completing TCP handshake; <code>-sT</code> performs a full TCP connect scan completing the handshake

💡 Hint

Consider how each scan interacts with the TCP handshake process.

-sS sends SYN packets and waits for SYN-ACK without completing the handshake, making it stealthier. -sT completes the full TCP handshake, which is more detectable.

❓ Reasoning

advanced

If you want to scan a target without sending any packets that establish a full TCP connection, which Nmap scan should you use?

Select the Nmap scan type that avoids completing the TCP handshake to reduce detection risk.

A -sS (SYN scan)

B -sT (TCP connect scan)

C -sU (UDP scan)

D -sA (ACK scan)

💡 Hint

Think about which scan sends SYN packets but does not complete the handshake.

The SYN scan (-sS) sends SYN packets and does not complete the TCP handshake, making it stealthier than the TCP connect scan (-sT), which completes the handshake.

❓ Comparison

expert

Given the Nmap output below, which port is confirmed open and why?

PORT    STATE  SERVICE
22/tcp  open   ssh
80/tcp  filtered http
443/tcp closed https

Analyze the port states and select the correct explanation for the open port.

A Port 80 is open because filtered means it is reachable

B Port 443 is open because it is closed but responds to probes

C Port 22 is open because Nmap received a response indicating the port is accepting connections

D Port 80 is open because it is filtered and may be open or closed

💡 Hint

Recall what 'open', 'filtered', and 'closed' mean in Nmap results.

'Open' means the port responded positively to connection attempts. 'Filtered' means packets are blocked or dropped by a firewall, so Nmap cannot determine if the port is open. 'Closed' means the port is reachable but not accepting connections.