Port scanning with Nmap in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Nmap used for in cybersecurity?

Nmap is a tool used to discover open ports and services on a network. It helps identify which ports on a computer or server are accessible and what services are running on them.

beginner

What does an 'open port' mean in a port scan?

An open port means that the port is accepting connections and a service is listening on it. This can be a way for attackers to find entry points into a system.

intermediate

Name two common types of scans Nmap can perform.

Two common scan types are TCP SYN scan (also called 'half-open' scan) and UDP scan. TCP SYN scan checks if ports respond to connection requests, while UDP scan checks for UDP services.

intermediate

What is the purpose of using the '-sS' option in Nmap?

The '-sS' option tells Nmap to perform a TCP SYN scan, which is fast and stealthy because it doesn't complete the full TCP handshake.

advanced

Why is port scanning considered both a useful and potentially risky activity?

Port scanning helps administrators find vulnerabilities and secure networks. However, unauthorized scanning can be seen as hostile and may trigger security alarms or legal issues.

What does Nmap primarily scan to find open services?

A File systems

B IP addresses only

C User passwords

D Network ports

Nmap scans network ports to find which ones are open and what services are running.

Which Nmap scan type is known as a 'half-open' scan?

A Ping scan

B UDP scan

C TCP SYN scan

D Full connect scan

TCP SYN scan sends a SYN packet and does not complete the full handshake, making it a 'half-open' scan.

What does an 'open' port indicate during a scan?

A Port is closed and blocked

B Port is accepting connections

C Port is filtered by firewall

D Port is inactive

An open port means it is accepting connections and a service is listening.

Which Nmap option performs a TCP SYN scan?

A -sS

B -sT

C -sU

D -sP

The '-sS' option tells Nmap to perform a TCP SYN scan.

Why should port scanning be done carefully and with permission?

A It may be illegal or trigger security alerts

B It can slow down your computer

C It deletes files on the target

D It always crashes the network

Unauthorized port scanning can be illegal and may trigger security alarms.

Explain what port scanning with Nmap is and why it is important in cybersecurity.

Think about how Nmap helps find open ports and services to protect networks.

Describe the difference between an open port and a closed port in the context of Nmap scanning.

Consider what it means for a port to be open or closed when scanning.