Which timing template corresponds to the Sneaky (1) IDS evasion level?

• A. -T0
• B. -T2
• C. -T3
• D. -T1

Answer: (D)

Timing templates control how aggressively Nmap sends probes, balancing speed with stealth. The Sneaky level, labeled as 1, maps to the timing option -T1. This template is designed to be stealthy enough to avoid triggering IDS/IPS rules, slowing down the scan and reducing probe frequency so traffic looks more like normal activity. It sits between the very cautious paranoid template (-T0) and the slightly faster polite template (-T2), offering a practical trade-off between covertness and completion time. So, for Sneaky (1) IDS evasion, the appropriate choice is the one that specifies -T1. The more paranoid option (-T0) is slower and extremely cautious, while the polite (-T2), normal (-T3), and aggressive (-T4) templates raise speed and detection risk, respectively.