A penetration tester is performing initial intelligence gathering on some remote hosts prior to conducting a vulnerability scan. The tester runs the following command: nmap -D 192.168.1.1, 192.168.1.2, 192.168.1.3 -sV -o --max-rate 2 192.168.1.130 Which of the following BEST describes why multiple IP addresses are specified?
A) The network is subnetted as a/25 or greater, and the tester needed to access hosts on two different subnets.
B) The tester is trying to perform a more stealthy scan by including several bogus addresses.
C) The scanning machine has several interfaces to balance the scan request across at the specified rate.
D) A discovery scan is run on the first set of addresses, whereas a deeper, more aggressive scan is run against the latter host.

Question

Quizplus · Accepted Answer

The -D option in nmap is used for decoy scanning, which involves using multiple IP addresses to make the scan appear as if it is coming from multiple sources, thus making it more stealthy.

A Penetration Tester Is Performing Initial Intelligence Gathering on Some