# Security+ Performance Based Questions (PBQ)

Scenario-based Nmap mastery: Moving from theory to practical exam application.

---

The CompTIA Security+ exam tests your ability to choose the **least intrusive** or **most comprehensive** command based on a set of constraints. Below are the most frequent scenarios you will encounter in the PBQ (Performance Based Questions) section.

## Scenario A: The "Stealth Recon" Audit

*A security analyst needs to identify open ports on a server without completing a full TCP connection to avoid being logged by the application layer.*

```
nmap -sS -T4 192.168.1.50
```

- **Exam Logic:** The `-sS` (SYN Scan) is the key. It sends a SYN, waits for a SYN/ACK, but then sends a **RST (Reset)** instead of an ACK. This is known as "Half-Open" scanning.

## Scenario B: Bypassing "No-Ping" Firewalls

*An administrator is trying to scan a host that is known to be 'Up', but the host is not responding to ICMP echo requests (Pings) because of a firewall.*

```
nmap -Pn 10.0.0.25
```

- **Exam Logic:** `-Pn` tells Nmap to "Skip Host Discovery." It assumes the host is online and proceeds directly to port scanning.

## Scenario C: Vulnerability & Version Discovery

*A technician needs to find out if an old web server is running an outdated version of Apache that is vulnerable to known exploits.*

```
nmap -sV --script vuln 172.16.5.10
```

- **Exam Logic:** `-sV` (Service Version) identifies the software version, and `--script vuln` uses the Nmap Scripting Engine (NSE) to check that version against a database of known vulnerabilities.

## Quick-Fire Command Reference Table

| Requirement                | Nmap Flag              | Why it's used                                              |
|----------------------------|------------------------|-----------------------------------------------------------|
| **Detect OS**              | `-O`                   | Analyzes the TCP/IP stack to guess the Operating System.  |
| **Scan UDP Ports**         | `-sU`                  | Finds DNS (53) or SNMP (161) services.                   |
| **Export to XML**          | `-oX filename.xml`     | Essential for importing scan data into other tools like **Nessus**. |
| **Full Aggressive**        | `-A`                   | Combines `-sV`, `-O`, `-sC`, and `traceroute`.            |
| **Identify Top Ports**     | `--top-ports 20`       | Scans only the 20 most common ports for maximum speed.    |