Exam PT0-002 All Questions

View all questions & answers for the PT0-002 exam

Exam PT0-002 topic 1 question 309 discussion

Actual exam question from CompTIA's PT0-002

Question #: 309
Topic #: 1

A security engineer is trying to bypass a network IPS that isolates the source when the scan exceeds 100 packets per minute. The scope of the san is to identify web servers in the 10.0.0.0/16 subnet. Which of the following commands should the engineer use to achieve the objective in the least amount of time?

A. nmap –T3 –p 80 10.0.0.0/16 ––max-hostgroup 100
B. nmap –T0 –p 80 10.0.0.0/16
C. nmap –T4 –p 80 10.0.0.0/16 ––max-rate 60
D. nmap –T5 –p 80 10.0.0.0/16 ––min-rate 80

Show Suggested Answer

Suggested Answer: B 🗳️

by deae0e6 at Feb. 29, 2024, 4:36 a.m.

Comments

Submit Cancel

Sebatian20

Highly Voted 1 year, 1 month ago

Selected Answer: B

B is the answer. C is wrong.. --max-rate is per SEC, not Min. Thus, setting --max-rate 60 is 60 per sec or 3,600 per min.

upvoted 17 times

outnumber_gargle024

1 year, 1 month ago

yup good catch. lotta follow the leader around here

upvoted 4 times

...

euca2023

Most Recent 2 months, 3 weeks ago

Selected Answer: B

even B isn't the best option others over the IPS limitation, so I'll go with B

upvoted 1 times

...

study_study

3 months ago

Selected Answer: C

C. It might not scan exactly 100 but the rate at which the scan will complete is much much faster than the multiple days that B would take and this is about efficiency. Doesn't seem to be a trick question, but maybe I'm wrong. You never know with CompTIA

upvoted 1 times

...

kinny4000

4 months, 3 weeks ago

Selected Answer: B

B is the answer, after doing some math I found that this scan would take between 3.8 and 7.6 days to complete. Paranoid is a good word for this type of scan, way too slow, a better choice would be T2 with --max-rate 1.5 which would take about 12 hours.

upvoted 1 times

...

Fart2023

7 months, 2 weeks ago

Selected Answer: C

You are all missing "the least amount of time" T0 is sloooowwww, C is correct.

upvoted 1 times

...

StillFiguringItOut

10 months, 2 weeks ago

Selected Answer: B

B is correct. Refer to Sebatian20 comment

upvoted 1 times

...

FasterN8

11 months, 3 weeks ago

Selected Answer: B

The --max-rate setting of nmap is measured in packets per SECOND. B. is the only option that can stay under 100 packets per MINUTE.

upvoted 1 times

...

djash22

11 months, 3 weeks ago

Considering the need to stay below 100 packets per minute while completing the scan in the least amount of time, Option C (nmap -T4 -p 80 10.0.0.0/16 --max-rate 60) is the best choice. It balances efficiency and compliance with the IPS limit, using a rate that is safely below the threshold and a timing template that expedites the scan without being overly aggressive

upvoted 1 times

...

Etc_Shadow28000

12 months ago

Selected Answer: C

C. nmap –T4 –p 80 10.0.0.0/16 ––max-rate 60: The –max-rate 60 option ensures that Nmap will not send more than 60 packets per second, which is well under the limit of 100 packets per minute. The T4 timing template balances speed and caution, allowing the scan to complete in a reasonable time frame while staying under the packet limit. A. While the –max-hostgroup option can control the number of hosts scanned in parallel, it doesn’t control the rate of packets sent. The T3 timing template might still exceed 100 packets per minute. B. The T0 timing template is very slow and would take a very long time to scan the entire subnet. D. The T5 timing template is very aggressive, and the –min-rate 80 option specifies a minimum rate of 80 packets per second, which would definitely exceed the 100 packets per minute limit set by the IPS.

upvoted 1 times

...

PhillyCheese

1 year ago

Selected Answer: A

upvoted 1 times

PhillyCheese

1 year ago

Please erase, this was posted by mistake.

upvoted 1 times

...

PhillyCheese

1 year ago

Selected Answer: B

--max-rate limits a scan's sending rate to a given maximum. Use --max-rate 100, for example, to limit sending to 100 packets per second on a fast network. https://nmap.org/book/man-performance.html The nmap command allows you to control the rate at which packets are sent during a scan. Here are the relevant options: --min-rate <number>: Specifies the minimum packet rate (packets per second). --max-rate <number>: Specifies the maximum packet rate (packets per second).

upvoted 2 times

PhillyCheese

1 year ago

While the fine-grained timing controls discussed in the previous section are powerful and effective, some people find them confusing. Moreover, choosing the appropriate values can sometimes take more time than the scan you are trying to optimize. Fortunately, Nmap offers a simpler approach, with six timing templates. You can specify them with the -T option and their number (0–5) or their name. The template names are paranoid (0), sneaky (1), polite (2), normal (3), aggressive (4), and insane (5). The first two are for IDS evasion. Polite mode slows down the scan to use less bandwidth and target machine resources. Normal mode is the default and so -T3 does nothing. Aggressive mode speeds scans up by making the assumption that you are on a reasonably fast and reliable network. Finally insane mode assumes that you are on an extraordinarily fast network or are willing to sacrifice some accuracy for speed.

upvoted 1 times

PhillyCheese

1 year ago

While -T0 and -T1 may be useful for avoiding IDS alerts, they will take an extraordinarily long time to scan thousands of machines or ports. For such a long scan, you may prefer to set the exact timing values you need rather than rely on the canned -T0 and -T1 values. The main effects of T0 are serializing the scan so only one port is scanned at a time, and waiting five minutes between sending each probe

upvoted 1 times

...

deeden

1 year, 3 months ago

Selected Answer: C

--max-rate <number>: Send packets no faster than <number> per second I agree with option C. Although the nmap --help show this number per second, meaning --max-rate 60 will potentially go up to 3600 packets per minute. The IPS blocks 100 packets per minute so I guess it ought to be lower than 60?

upvoted 1 times

...

041ba31

1 year, 3 months ago

Selected Answer: C

Option C specifies a scan (nmap) targeting port 80 (common for web servers) across the 10.0.0.0/16 subnet. It uses the --max-rate option to limit the scan rate to 60 packets per minute, staying below the IPS threshold of 100 packets per minute. The -T4 option speeds up the scan while still respecting the rate limit, optimizing for both efficiency and stealth

upvoted 1 times

...

Big_Dre

1 year, 3 months ago

Selected Answer: C

C. nmap –T4 –p 80 10.0.0.0/16 ––max-rate 60: This option explicitly sets the maximum scan rate to 60 packets per second, which is below the IPS threshold, and it scans port 80 as required. Therefore, this seems to be the best option.

upvoted 2 times

...

Rezaee

1 year, 4 months ago

Selected Answer: C

C. nmap –T4 –p 80 10.0.0.0/16 ––max-rate 60

upvoted 1 times

...

deae0e6

1 year, 4 months ago

B is the answer the others will all exceed 100 packets per minute as the min and max rate set the packets per second

upvoted 4 times

...