When would you use -Pn (no ping) and what is the trade-off?

• A. Use when host discovery is blocked or unreliable; treats all targets as up, which can waste time on down hosts and reduce accuracy.
• B. Use when you want to perform an initial DNS lookup before scanning.
• C. Use when you want to disable traceroute output.
• D. Use to specify a custom port range for scanning.

Answer: (A)

When you can’t rely on host discovery, you use -Pn to skip the initial ping/host-detection step and treat all specified targets as if they are online, proceeding with the port and service scans anyway. This is helpful when hosts are behind firewalls or filters that block or ignore ping requests, making normal discovery unreliable or incomplete.

The trade-off is that you’ll end up scanning targets that may be down, which wastes time and bandwidth and can slow the overall scan. It also makes it harder to distinguish truly live hosts from those you’re probing blindly, so the scan results are less efficient and can appear less accurate in terms of identifying which hosts are actually up.