Which Nmap command bypasses an IPS with a 100-packet-per-minute limit?

PT0-002 By islever Editorial Last updated

Short answer

B nmap –T0 –p 80 10.0.0.0/16

Question

A security engineer is trying to bypass a network IPS that isolates the source when the scan exceeds 100 packets per minute. The scope of the san is to identify web servers in the 10.0.0.0/16 subnet. Which of the following commands should the engineer use to achieve the objective in the least amount of time?
  1. nmap –T3 –p 80 10.0.0.0/16 ––max-hostgroup 100
  2. nmap –T0 –p 80 10.0.0.0/16 Correct Answer
  3. nmap –T4 –p 80 10.0.0.0/16 ––max-rate 60
  4. nmap –T5 –p 80 10.0.0.0/16 ––min-rate 80

Key Takeaways

The exam is testing whether you know that Nmap's --max-rate and --min-rate are packets per second, and the common trap is thinking a value of '60' is under 100 packets per minute.

CompTIA PT0-002 scan questions often test Nmap timing templates and rate-limiting options against an IPS packet threshold. The community consensus is that nmap -T0 -p 80 10.0.0.0/16 is correct because --max-rate is measured in packets per second, so the tempting option C actually exceeds 100 packets per minute.

Common mistake: Choosing C (`--max-rate 60`) because 60 looks below 100, but 60 packets per second equals 3,600 packets per minute, which trips the IPS; B (T0 paranoid) is the only option that safely stays below the threshold.

Expert Analysis

Why the Answer Is Correct

Option B uses Nmap's T0 paranoid timing template, which sends one probe and then waits 5 minutes (300 seconds) before the next probe. That produces a rate far below the IPS limit of 100 packets per minute, so the scan will not be isolated. Although T0 is extremely slow, it is the only command among the four that actually satisfies the primary requirement of bypassing the IPS.

Why the Other Options Are Wrong

Option C is the most common wrong choice because --max-rate 60 limits Nmap to 60 packets per second, not 60 packets per minute; this equals 3,600 packets per minute and would trigger the IPS. Option D uses --min-rate 80, which forces at least 80 packets per second and is even worse. Option A uses --max-hostgroup 100 to control host grouping but does not limit packet rate, and the T3 timing template can easily exceed 100 packets per minute.

Community Comment Notes

Sebastian20's comment [1] clearly explains that C is wrong because --max-rate is measured per second, giving 3,600 packets per minute. Other commenters [10] repeat that B is the only option that stays below 100 packets per minute. Some commenters [8] argue that C is better because the question says 'least amount of time,' but they miss that C violates the IPS limit; the exam prioritizes the security constraint over raw speed.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

For any IPS/Nmap rate question, convert Nmap's rate options to packets per minute before comparing to the threshold. Remember that --max-rate and --min-rate are per-second values, while T0 (paranoid) is the built-in slow template designed to evade IDS/IPS.

Community Votes

B
73%
C
27%

73% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 16 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 16

  1. Sebatian20 👍 16 Answered B
    B is the answer. C is wrong.. --max-rate is per SEC, not Min. Thus, setting --max-rate 60 is 60 per sec or 3,600 per min.
  2. deae0e6 👍 4
    B is the answer the others will all exceed 100 packets per minute as the min and max rate set the packets per second
  3. PhillyCheese 👍 2 Answered B
    --max-rate limits a scan's sending rate to a given maximum. Use --max-rate 100, for example, to limit sending to 100 packets per second on a fast network. https://nmap.org/book/man-performance.html The nmap command allows you to control the rate at which packets are sent during a scan. Here are the relevant options: --min-rate <number>: Specifies the minimum packet rate (packets per second). --max-rate <number>: Specifies the maximum packet rate (packets per second).
  4. Big_Dre 👍 2 Answered C
    C. nmap –T4 –p 80 10.0.0.0/16 ––max-rate 60: This option explicitly sets the maximum scan rate to 60 packets per second, which is below the IPS threshold, and it scans port 80 as required. Therefore, this seems to be the best option.
  5. Etc_Shadow28000 👍 1 Answered C
    C. nmap –T4 –p 80 10.0.0.0/16 ––max-rate 60: The –max-rate 60 option ensures that Nmap will not send more than 60 packets per second, which is well under the limit of 100 packets per minute. The T4 timing template balances speed and caution, allowing the scan to complete in a reasonable time frame while staying under the packet limit. A. While the –max-hostgroup option can control the number of hosts scanned in parallel, it doesn’t control the rate of packets sent. The T3 timing template might still exceed 100 packets per minute. B. The T0 timing template is very slow and would take a very long time to scan the entire subnet. D. The T5 timing template is very aggressive, and the –min-rate 80 option specifies a minimum rate of 80 packets per second, which would definitely exceed the 100 packets per minute limit set by the IPS.
Show 11 more comments
  1. djash22 👍 1
    Considering the need to stay below 100 packets per minute while completing the scan in the least amount of time, Option C (nmap -T4 -p 80 10.0.0.0/16 --max-rate 60) is the best choice. It balances efficiency and compliance with the IPS limit, using a rate that is safely below the threshold and a timing template that expedites the scan without being overly aggressive
  2. 041ba31 👍 1 Answered C
    Option C specifies a scan (nmap) targeting port 80 (common for web servers) across the 10.0.0.0/16 subnet. It uses the --max-rate option to limit the scan rate to 60 packets per minute, staying below the IPS threshold of 100 packets per minute. The -T4 option speeds up the scan while still respecting the rate limit, optimizing for both efficiency and stealth
  3. PhillyCheese 👍 1 Answered A
    A security engineer is trying to bypass a network IPS that isolates the source when the scan exceeds 100 packets per minute. The scope of the san is to identify web servers in the 10.0.0.0/16 subnet. Which of the following commands should the engineer use to achieve the objective in the least amount of time?
  4. deeden 👍 1 Answered C
    --max-rate <number>: Send packets no faster than <number> per second I agree with option C. Although the nmap --help show this number per second, meaning --max-rate 60 will potentially go up to 3600 packets per minute. The IPS blocks 100 packets per minute so I guess it ought to be lower than 60?
  5. study_study 👍 1 Answered C
    C. It might not scan exactly 100 but the rate at which the scan will complete is much much faster than the multiple days that B would take and this is about efficiency. Doesn't seem to be a trick question, but maybe I'm wrong. You never know with CompTIA
  6. kinny4000 👍 1 Answered B
    B is the answer, after doing some math I found that this scan would take between 3.8 and 7.6 days to complete. Paranoid is a good word for this type of scan, way too slow, a better choice would be T2 with --max-rate 1.5 which would take about 12 hours.
  7. FasterN8 👍 1 Answered B
    The --max-rate setting of nmap is measured in packets per SECOND. B. is the only option that can stay under 100 packets per MINUTE.
  8. euca2023 👍 1 Answered B
    even B isn't the best option others over the IPS limitation, so I'll go with B
  9. Fart2023 👍 1 Answered C
    You are all missing "the least amount of time" T0 is sloooowwww, C is correct.
  10. Rezaee 👍 1 Answered C
    C. nmap –T4 –p 80 10.0.0.0/16 ––max-rate 60
  11. StillFiguringItOut 👍 1 Answered B
    B is correct. Refer to Sebatian20 comment

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Which Post-Report Activity Prevents CISO Disputing Finding Validity?

S-grade

How should penetration testers prioritize findings in a report?

S-grade

Which agreement did a pen tester breach by requesting a CVE without authorization?

S-grade

Which Tool Best Detects Vulnerabilities on a Database Server?

S-grade

← Back to PT0-002 Study Guide