Which option is used to scan UDP ports?

• A. -sT
• B. -sW
• C. -sU
• D. -PI

Answer: (C)

UDP port scanning tests UDP services by sending UDP packets to ports and interpreting the responses or ICMP error messages that come back. This approach is what the UDP-scanning flag instructs Nmap to do, making it the best choice for checking which UDP ports are open, closed, or filtered. Because UDP is connectionless and many services don’t reply unless there’s a reason, a UDP scan can be slower and more nuanced: a port may appear open if there’s a reply, closed if an ICMP port-unreachable message is received, or filtered if there’s no helpful reply at all.

The other options target different methods: one conducts a TCP connect scan, which tries to complete a full TCP handshake to test TCP ports; another uses a TCP window probe technique, also TCP-specific; and another is used for host discovery via ICMP probes rather than probing UDP ports.