Given that you are conducting an internal penetration test and need to enumerate assets within the organization’s network, which Nmap command or script would you use to produce the most comprehensive list of live hosts, open ports, and services?
The correct answer is -sV -O --script=all. The -sV option enables version detection, probing open ports to determine service/version info, while the -O option triggers OS detection. Combining these with --script=all applies a variety of scripts for further enumeration, including default and non-default scripts that check for a wide range of vulnerabilities and configurations, making it the most comprehensive choice for asset enumeration. -sn only performs host discovery, which would not enumerate open ports or services. --top-ports only scans the most common ports, which might miss out on less common but potentially critical ports. -Pn disables host discovery and should only be used when ensuring all ports are scanned regardless of the host being up.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What does the -sV option do in Nmap?
Open an interactive chat with Bash
What are Nmap scripts, and how does --script=all work?
Open an interactive chat with Bash
Why is OS detection important in penetration testing?