Which Nmap Command Identifies Common TCP Ports on a Target?
A penetration tester wants to identify the most common TCP ports on 10.7.8.69. Which of the following is the best Nmap command for this task?
Community Votes
60% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests your knowledge of Nmap's port scan flags and the concept of 'fast scan' for common ports, with a trap around combining incompatible TCP scan types like -sS and -sA.
This PT0-002 question asks which Nmap command best identifies the most common TCP ports on 10.7.8.69. The official answer is A (-sS -sA -sV -F), though community comments note Nmap does not allow combining -sS and -sA and favor C (-sC -sV -Pn) as a working alternative.
Many candidates pick C because it runs successfully and provides results, but the exam key prefers A because -F explicitly targets the top common TCP ports; however, be aware that -sS and -sA together will cause an error in standard Nmap.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The exam key lists A as the best command because it uses -sS (SYN scan) for fast open-port discovery, -sA (ACK scan) to understand firewall filtering, -sV for service version identification, and -F to limit scanning to the most common top 100 ports. This combination targets the question's requirement to identify the most common TCP ports efficiently. In a multiple-choice CompTIA exam, you should select the option that best matches the intended objective, even if the exact syntax may fail in certain Nmap versions.
Why the Other Options Are Wrong
Option B is wrong because it combines -sT and -sA (two TCP scan types) and scans all 65,535 ports, which is broader than needed for 'most common' ports. Option D is wrong because -sX (Xmas scan) mixed with -sU is not a focused TCP top-ports scan, and --top-ports requires a numeric argument. Option C is technically valid and will scan the default top 1,000 TCP ports, but it lacks the explicit fast-scan flag (-F) and adds default scripts, making it slower and not the exam's best answer.
Community Comment Notes
A highly-voted comment (6 likes) explains in detail why A is correct: -sS is efficient, -sA checks for filtering, -sV fingerprints services, and -F scans the top 100 ports. However, two other commenters (2 likes each) report that in a lab, A produced the error 'You specified more than one type of TCP scan' because -sS and -sA cannot be combined, and only C (nmap -sC -sV -Pn) worked. One commenter adds that in Nmap context, 'most common ports' usually refers to the top 1,000 ports, which supports C. These comments show a real-world syntax conflict, but the official exam answer is still A.
Official Reference
Exam Strategy
On PT0-002, focus on what each Nmap flag is designed to do rather than whether the command runs in your lab. If you encounter A and C, remember the exam wants you to pick the command that uses -F for the most common ports and includes version detection; save your real-world testing for actual penetration tests.