Question

what does nmap use to determine whether a host is present when used without switches?

a it pings and sends a tcp ack packet to ports 80 and 443.
b it performs a full database scan.
c it listens for any active bluetooth devices.
d it sends an email to the network administrator.

Explanation:

Analyze default Nmap host discovery behavior

By default, when Nmap is run without any host discovery switches (such as -Pn or -sn), it performs a default host discovery (ping scan) to determine if a target host is online before scanning its ports.

Evaluate the default discovery probes

For a privileged user on a local network, Nmap uses ARP/Neighbor Discovery. However, for external/routed targets, the default host discovery sequence consists of:

1. An ICMP Echo Request (ping)
2. A TCP SYN packet to port 443
3. A TCP ACK packet to port 80
4. An ICMP Timestamp Request

Match with the given options

Option A states: "It pings and sends a TCP ACK packet to ports 80 and 443." (While technically Nmap sends a TCP SYN to 443 and a TCP ACK to 80, this option is the only one that accurately describes the network-level pinging and TCP probing mechanism used by Nmap for host discovery). The other options (database scan, Bluetooth listening, sending an email) are entirely incorrect.

Answer:

• (A) It pings and sends a TCP ACK packet to ports 80 and 443. (Correct answer)
• (B) It performs a full database scan.
• (C) It listens for any active Bluetooth devices.
• (D) It sends an email to the network administrator.