What is the purpose of the -sV switch in Nmap, and what kind of data does it attempt to extract from open ports?

• A. Enables version detection by probing services to identify software and version numbers.
• B. Enables OS detection by analyzing stack responses.
• C. Initiates a TCP connect scan to complete the three-way handshake.
• D. Runs the default NSE scripts for scripting.

Answer: (A)

The main idea here is identifying exactly what software is running on open ports and which version it is. The -sV switch tells Nmap to perform version detection by probing services and analyzing their responses. It uses a fingerprint database and observed banners or protocol data to map what it sees to a specific product and version, often returning details like the service name, vendor, and version number (and sometimes extra information such as build or TLS certificate details). This makes it possible to understand not just that a port is open, but what is actually running behind it and how up to date it might be. It’s distinct from OS detection, which looks at the host's operating system, from a simple connect scan, which just proves reachability, and from NSE scripting, which runs scripts for broader data collection.