Exam PT1-002 topic 1 question 48 discussion

Option d (nmap –p0 –T0 –sS 192.168.1.10) performs a SYN scan ("-sS") with no port scanning ("-p0") and the lowest timing template ("-T0"). While SYN scans are commonly used for stealthy scanning, the absence of port scanning may not provide useful information for the penetration tester's objectives.

I agree with C, especially since it is documented in https://nmap.org/book/man-bypass-firewalls-ids.html as to what options to use to bypass firewalls and IDS. Why dispute an official nmap guide?

@OSPFv22 this is an underated comment. based on this: "While this simple command is often all that is needed, advanced users often go much further. In Example 4.3, the scan is modified with four options. -p0- asks Nmap to scan every possible TCP port, -v asks Nmap to be verbose about it, -A enables aggressive tests such as remote OS detection, service/version detection, and the Nmap Scripting Engine (NSE). Finally, -T4 enables a more aggressive timing policy to speed up the scan. Example 4.3. More complex: nmap -p0- -v -A -T4 scanme.nmap.org" https://nmap.org/book/port-scanning-tutorial.html I'm not 100%... based on NMAP documentation, both A and C seem to be viable answers. -p0 will not flag the IDS MOST LIKELY since they are T0 scans (paranoid) and running -Ss, this is common knowledge. On the other hand, you have nmap documentation that specifically has -f and --badsum under the IDS/FIREWALL EVASION page... ahhh, what to choose. Thanks CompTIA.