Final answer:
When nmap is run without a scan type flag, it defaults to a TCP SYN scan, also known as a stealth scan. This is chosen for its speed and efficiency in network reconnaissance.
Step-by-step explanation:
The default nmap scan type, when no specific scan type flag is provided, is a TCP SYN scan. This scan type is also referred to as a "stealth scan" because it can be less detectable by the target host's intrusion detection systems. When you run nmap without specifying a scan type, it defaults to this TCP SYN scan for its speed and efficiency. However, should the user not have the necessary raw packet privileges, nmap would fall back to performing a TCP connect scan.
L