Swiss Army Knife of Networking

AI Strategy umais20@yahoo.com January 03, 2026
Security+ Performance Based Questions (PBQ)

Scenario-based Nmap mastery: Moving from theory to practical exam application.


The CompTIA Security+ exam tests your ability to choose the least intrusive or most comprehensive command based on a set of constraints. Below are the most frequent scenarios you will encounter in the PBQ (Performance Based Questions) section.

Scenario A: The "Stealth Recon" Audit

"A security analyst needs to identify open ports on a server without completing a full TCP connection to avoid being logged by the application layer."

nmap -sS -T4 192.168.1.50
  • Exam Logic: The -sS (SYN Scan) is the key. It sends a SYN, waits for a SYN/ACK, but then sends a RST (Reset) instead of an ACK. This is known as "Half-Open" scanning.

Scenario B: Bypassing "No-Ping" Firewalls

"An administrator is trying to scan a host that is known to be 'Up', but the host is not responding to ICMP echo requests (Pings) because of a firewall."

nmap -Pn 10.0.0.25
  • Exam Logic: -Pn tells Nmap to "Skip Host Discovery." It assumes the host is online and proceeds directly to port scanning.

Scenario C: Vulnerability & Version Discovery

"A technician needs to find out if an old web server is running an outdated version of Apache that is vulnerable to known exploits."

nmap -sV --script vuln 172.16.5.10
  • Exam Logic: -sV (Service Version) identifies the software version, and --script vuln uses the Nmap Scripting Engine (NSE) to check that version against a database of known vulnerabilities.

Quick-Fire Command Reference Table

Requirement Nmap Flag Why it's used
Detect OS -O Analyzes the TCP/IP stack to guess the Operating System.
Scan UDP Ports -sU Finds DNS (53) or SNMP (161) services.
Export to XML -oX filename.xml Essential for importing scan data into other tools like Nessus.
Full Aggressive -A Combines -sV, -O, -sC, and traceroute.
Identify Top Ports --top-ports 20 Scans only the 20 most common ports for maximum speed.

The Guru's Exam Tip

If the exam asks for a "comprehensive" scan that includes scripts and OS detection, always look for the Aggressive (-A) flag. If it asks for "Stealth," look for the SYN Scan (-sS).

Ready to practice? Try scanning scanme.nmap.org (this is the official legal testing site provided by Nmap).

Community Discussion (0)

Leave a Comment

No approved comments yet. Be the first to start the conversation!

Heartbeat Assistant