You run `nmap 192.0.2.10` as an ordinary user rather than as root, and the output reports a connect scan. Why does nmap not use its usual default scan here?
LPIC-1 Exam 102-500, objective 110. Security medium
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Correct A SYN scan needs raw packet privileges, so without them nmap falls back to a TCP connect scan that uses the ordinary connect() system call.
Correct. -sS crafts raw packets and requires root; an unprivileged user gets -sT, which completes a full three-way handshake through the socket API.
Not correct Unprivileged users may only scan hosts on the local subnet, and connect scans are the only type permitted off-link.
Wrong. There is no such subnet restriction; the constraint is the ability to build raw packets, not the location of the target.
Not correct nmap defaults to a UDP scan for non-root users because UDP requires no handshake.
Wrong. UDP scanning (-sU) also needs raw sockets, and it is never the default for either kind of user.
Not correct The connect scan is chosen because it is stealthier and leaves no entry in the target's logs.
Wrong. It is the reverse: a connect scan completes the handshake and is readily logged by the service, whereas the SYN scan is described as half-open precisely because it usually is not.
Why
nmap's default TCP scan is the SYN scan (-sS), which sends a bare SYN and abandons the handshake on the reply, but building those packets requires raw socket access and therefore root. When nmap has no such privilege it selects the TCP connect scan (-sT), handing the work to the kernel's connect() call, which completes the handshake and is consequently both slower and more visible in the target's logs. The port state conclusions are the same; only the mechanism and the footprint differ.
Where this comes from
- Cited
- manual page nmap(1)
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 110 and space the ones you get wrong.
More questions on this objective
- During an audit you must list every file under /usr that has the set-user-ID bit set, regardless of what its other permission bits are. Which command does that? machine-checked
- You locked the password of the account `intern` and confirmed that its hash in /etc/shadow now begins with an exclamation mark. The intern nevertheless still reaches a shell on the host over SSH, without being prompted for anything. What is going on, and what actually stops it? machine-checked
- You have just been added to a sudo rule on a host and want sudo itself to report which commands you are allowed to run there, without running any of them. Type the complete command. machine-checked
- A daemon started from your bash session keeps hitting a 'too many open files' error. Which command raises the limit on open file descriptors for the current shell and the processes it starts to 4096? machine-checked
- You are about to take a server down for maintenance and want ordinary users refused at login for the next hour, with an explanatory message, while root can still get in. On a system using PAM's pam_nologin, creating which file achieves this? machine-checked
- Which two commands report the users who are logged in right now, rather than a history of past logins? (Choose two.) machine-checked