Which Nmap command bypasses an IPS with a 100-packet-per-minute limit?

A security engineer is trying to bypass a network IPS that isolates the source when the scan exceeds 100 packets per minute. The scope of the san is to identify web servers in the 10.0.0.0/16 subnet. Which of the following commands should the engineer use to achieve the objective in the least amount of time?

nmap –T3 –p 80 10.0.0.0/16 ––max-hostgroup 100
nmap –T0 –p 80 10.0.0.0/16 Source Reference Answer
nmap –T4 –p 80 10.0.0.0/16 ––max-rate 60
nmap –T5 –p 80 10.0.0.0/16 ––min-rate 80

Community Votes

73%

27%

73% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The exam is testing whether you know that Nmap's --max-rate and --min-rate are packets per second, and the common trap is thinking a value of '60' is under 100 packets per minute.

CompTIA PT0-002 scan questions often test Nmap timing templates and rate-limiting options against an IPS packet threshold. The community consensus is that nmap -T0 -p 80 10.0.0.0/16 is correct because --max-rate is measured in packets per second, so the tempting option C actually exceeds 100 packets per minute.

Choosing C (`--max-rate 60`) because 60 looks below 100, but 60 packets per second equals 3,600 packets per minute, which trips the IPS; B (T0 paranoid) is the only option that safely stays below the threshold.

Community Discussion (16 comments)

Sebatian20 👍 16 Selected: B

B is the answer. C is wrong.. --max-rate is per SEC, not Min. Thus, setting --max-rate 60 is 60 per sec or 3,600 per min.

euca2023 👍 1 Selected: B

even B isn't the best option others over the IPS limitation, so I'll go with B

study_study 👍 1 Selected: C

C. It might not scan exactly 100 but the rate at which the scan will complete is much much faster than the multiple days that B would take and this is about efficiency. Doesn't seem to be a trick question, but maybe I'm wrong. You never know with CompTIA

kinny4000 👍 1 Selected: B

B is the answer, after doing some math I found that this scan would take between 3.8 and 7.6 days to complete. Paranoid is a good word for this type of scan, way too slow, a better choice would be T2 with --max-rate 1.5 which would take about 12 hours.

Fart2023 👍 1 Selected: C

You are all missing "the least amount of time" T0 is sloooowwww, C is correct.

StillFiguringItOut 👍 1 Selected: B

B is correct. Refer to Sebatian20 comment

FasterN8 👍 1 Selected: B

The --max-rate setting of nmap is measured in packets per SECOND. B. is the only option that can stay under 100 packets per MINUTE.

djash22 👍 1

Considering the need to stay below 100 packets per minute while completing the scan in the least amount of time, Option C (nmap -T4 -p 80 10.0.0.0/16 --max-rate 60) is the best choice. It balances efficiency and compliance with the IPS limit, using a rate that is safely below the threshold and a timing template that expedites the scan without being overly aggressive

Etc_Shadow28000 👍 1 Selected: C

C. nmap –T4 –p 80 10.0.0.0/16 ––max-rate 60: The –max-rate 60 option ensures that Nmap will not send more than 60 packets per second, which is well under the limit of 100 packets per minute. The T4 timing template balances speed and caution, allowing the scan to complete in a reasonable time frame while staying under the packet limit. A. While the –max-hostgroup option can control the number of hosts scanned in parallel, it doesn’t control the rate of packets sent. The T3 timing template might still exceed 100 packets per minute. B. The T0 timing template is very slow and would take a very long time to scan the entire subnet. D. The T5 timing template is very aggressive, and the –min-rate 80 option specifies a minimum rate of 80 packets per second, which would definitely exceed the 100 packets per minute limit set by the IPS.

PhillyCheese 👍 1 Selected: A

PhillyCheese 👍 2 Selected: B

--max-rate limits a scan's sending rate to a given maximum. Use --max-rate 100, for example, to limit sending to 100 packets per second on a fast network. https://nmap.org/book/man-performance.html The nmap command allows you to control the rate at which packets are sent during a scan. Here are the relevant options: --min-rate <number>: Specifies the minimum packet rate (packets per second). --max-rate <number>: Specifies the maximum packet rate (packets per second).

deeden 👍 1 Selected: C

--max-rate <number>: Send packets no faster than <number> per second I agree with option C. Although the nmap --help show this number per second, meaning --max-rate 60 will potentially go up to 3600 packets per minute. The IPS blocks 100 packets per minute so I guess it ought to be lower than 60?

041ba31 👍 1 Selected: C

Option C specifies a scan (nmap) targeting port 80 (common for web servers) across the 10.0.0.0/16 subnet. It uses the --max-rate option to limit the scan rate to 60 packets per minute, staying below the IPS threshold of 100 packets per minute. The -T4 option speeds up the scan while still respecting the rate limit, optimizing for both efficiency and stealth

Big_Dre 👍 2 Selected: C

C. nmap –T4 –p 80 10.0.0.0/16 ––max-rate 60: This option explicitly sets the maximum scan rate to 60 packets per second, which is below the IPS threshold, and it scans port 80 as required. Therefore, this seems to be the best option.

Rezaee 👍 1 Selected: C

C. nmap –T4 –p 80 10.0.0.0/16 ––max-rate 60

deae0e6 👍 4

B is the answer the others will all exceed 100 packets per minute as the min and max rate set the packets per second

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Option B uses Nmap's T0 paranoid timing template, which sends one probe and then waits 5 minutes (300 seconds) before the next probe. That produces a rate far below the IPS limit of 100 packets per minute, so the scan will not be isolated. Although T0 is extremely slow, it is the only command among the four that actually satisfies the primary requirement of bypassing the IPS.

Why the Other Options Are Wrong

Option C is the most common wrong choice because --max-rate 60 limits Nmap to 60 packets per second, not 60 packets per minute; this equals 3,600 packets per minute and would trigger the IPS. Option D uses --min-rate 80, which forces at least 80 packets per second and is even worse. Option A uses --max-hostgroup 100 to control host grouping but does not limit packet rate, and the T3 timing template can easily exceed 100 packets per minute.

Community Comment Notes

Sebastian20's comment [1] clearly explains that C is wrong because --max-rate is measured per second, giving 3,600 packets per minute. Other commenters [10] repeat that B is the only option that stays below 100 packets per minute. Some commenters [8] argue that C is better because the question says 'least amount of time,' but they miss that C violates the IPS limit; the exam prioritizes the security constraint over raw speed.

Official Reference

Exam Strategy

For any IPS/Nmap rate question, convert Nmap's rate options to packets per minute before comparing to the threshold. Remember that --max-rate and --min-rate are per-second values, while T0 (paranoid) is the built-in slow template designed to evade IDS/IPS.

Related Analysis

← Back to PT0-002 Study Guide