I85PREP
⌘ K
MSF RCP study materials
MSF RCP study resources

MSF RCP practice questions

One question at a time. Build your MSF RCP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Metasploit Framework fundamentals and architecture

In the Metasploit Framework, what is the primary role of msfconsole?

  1. It performs network vulnerability scanning without any modules
  2. It compiles exploit code into standalone binaries
  3. It replaces the database backend with a flat-file store
  4. It provides the main interactive command-line interface for the Framework Correct answer.

Explanation

msfconsole is the central interactive console through which a tester loads modules, sets options, runs exploits, manages sessions, and interacts with the database. It is the primary user-facing shell of the Framework rather than a compiler or standalone scanner.

Question 2Metasploit Framework fundamentals and architecture

Which module type in Metasploit is designed to perform tasks such as scanning, fuzzing, and service enumeration without delivering a payload?

  1. Auxiliary Correct answer.
  2. Nop
  3. Encoder
  4. Evasion

Explanation

Auxiliary modules carry out supporting actions like port scanning, banner grabbing, and fuzzing, and they do not pair with a payload the way exploits do. Encoders, NOP generators, and evasion modules instead transform or shape payloads.

Question 3Metasploit Framework fundamentals and architecture

A tester wants to see every available module in the current msfconsole session without filtering by type. Which command lists all modules?

  1. show options
  2. show exploits
  3. search *
  4. show all Correct answer.

Explanation

The show all command enumerates modules across every type in the current console. show options displays settings for the currently selected module, and show exploits restricts output to the exploit type only.

Question 4Metasploit Framework fundamentals and architecture

What does the setg command do inside msfconsole?

  1. Generates a payload with the given options
  2. Sets the target host list for a scan
  3. Assigns a global value that persists across modules Correct answer.
  4. Sets an option for the current module only

Explanation

setg stores a value in the global datastore so it applies to subsequently loaded modules in the session. The plain set command, by contrast, affects only the currently active module.

Question 5Metasploit Framework fundamentals and architecture

Which Metasploit component is responsible for generating standalone payload files, such as executables and raw shellcode, outside the console?

  1. msfrpcd
  2. msfupdate
  3. msfvenom Correct answer.
  4. msfdb

Explanation

msfvenom is the standalone payload generator that combines payload selection, encoding, and output formatting into a single command. It replaced the older msfpayload and msfencode utilities.

Question 6Metasploit Framework fundamentals and architecture

What is a Metasploit session?

  1. A database record describing a scanned host
  2. A saved configuration profile for a module
  3. A queue of exploits waiting to be launched
  4. An active connection established with a compromised or interacting target Correct answer.

Explanation

A session represents a live channel between the tester and a target, created when a payload such as a shell or Meterpreter runs successfully. Sessions are managed with commands like sessions -l and sessions -i.

Question 7Metasploit Framework fundamentals and architecture

Which file in a Metasploit installation conventionally stores module search paths and general Framework settings?

  1. msfconsole.rc
  2. msfvenom.conf
  3. framework.log
  4. config/database.yml Correct answer.

Explanation

The config/database.yml file under the Framework installation holds database connection settings, and general configuration lives alongside it in the config directory. Resource scripts and log files serve different purposes.

Question 8Metasploit Framework fundamentals and architecture

A tester loads an exploit module and runs show options. The RHOSTS field is blank and marked required. What is the correct next action before running the exploit?

  1. Use set RHOSTS <target> to assign the target address Correct answer.
  2. Run check to confirm the target is set
  3. Use setg PAYLOAD to choose a payload
  4. Run sessions -l to list existing targets

Explanation

RHOSTS is a required datastore option that identifies the target host or range, so it must be populated with set before the module can run. Payload selection is a separate step and does not supply the target address.

Question 9Metasploit Framework fundamentals and architecture

A tester wants to select the Meterpreter reverse TCP payload for a Windows exploit. Which value should be assigned to the PAYLOAD option?

  1. windows/meterpreter/reverse_tcp Correct answer.
  2. windows/x64/shell_reverse_tcp
  3. meterpreter/reverse_tcp
  4. windows/meterpreter/reverse_tcp_https

Explanation

Payload names follow the platform/architecture/type/transport convention, so the 32-bit Windows Meterpreter reverse TCP payload is windows/meterpreter/reverse_tcp. The other values either omit the platform or name a different payload family.

Question 10Metasploit Framework fundamentals and architecture

What is the purpose of the check command when run against an exploit module?

  1. It checks the syntax of the current resource script
  2. It confirms the database connection is active
  3. It verifies the selected payload will execute on the target
  4. It tests whether the target appears vulnerable without delivering the payload Correct answer.

Explanation

check attempts to determine exploitability of the target and reports a vulnerability state without firing the payload. Not all modules implement it, so support varies.

Question 11Metasploit Framework fundamentals and architecture

A tester wants the exploit to keep running in the background and return control to the console immediately after launching. Which option accomplishes this?

  1. set WfsDelay 0
  2. set ExitOnSession false Correct answer.
  3. set VERBOSE true
  4. set PrependMigrate true

Explanation

Setting ExitOnSession to false keeps the handler listening after a session opens, and running the module with the -j flag backgrounds the job so the console is returned. VERBOSE, WfsDelay, and PrependMigrate control output and payload behavior rather than backgrounding.

Question 12Metasploit Framework fundamentals and architecture

After a session is opened, a tester runs sessions -i 2. What is the result?

  1. It kills session 2
  2. It upgrades session 2 to Meterpreter
  3. It lists the details of session 2
  4. It interacts with session 2 Correct answer.

Explanation

The -i flag switches the console into interaction mode with the numbered session, allowing commands to be sent to it. Listing sessions uses -l, and killing a session uses -k.

Question 13Metasploit Framework fundamentals and architecture

What does the search command accept in msfconsole to narrow module results?

  1. Only regular expressions prefixed with a slash
  2. Keywords plus filters such as type, platform, or CVE Correct answer.
  3. Only exact module path names
  4. Only numeric module IDs

Explanation

search matches keywords across module metadata and also supports filters like type:, platform:, and cve: to constrain results. This makes it broader than exact-name or numeric lookups.

Question 14Metasploit Framework fundamentals and architecture

A tester wants to see the source and description of a module before using it. Which command displays the module's details?

  1. show payloads
  2. info Correct answer.
  3. back
  4. use

Explanation

The info command prints the module description, authors, references, and options. show payloads lists compatible payloads, back leaves the module context, and use selects a module.

Question 15Metasploit Framework fundamentals and architecture

Which database command in msfconsole imports results of an Nmap scan into the Framework database?

  1. db_status
  2. db_connect
  3. db_nmap Correct answer.
  4. db_import

Explanation

db_nmap runs Nmap and records the results directly into the Framework database. db_import ingests previously saved scan files, while db_status and db_connect manage the database connection.

Question 16Metasploit Framework fundamentals and architecture

A tester has a saved Nmap XML file and wants its hosts and services recorded in the Metasploit database. Which command should be used?

  1. db_nmap
  2. hosts
  3. db_import Correct answer.
  4. services

Explanation

db_import parses a saved scan file, such as Nmap XML, and stores hosts and services in the database. db_nmap would run a new scan instead of importing the existing file.

Question 17Metasploit Framework fundamentals and architecture

What is the function of Meterpreter in the Metasploit architecture?

  1. It is the RPC daemon that exposes the Framework API
  2. It is an advanced payload that runs in memory and provides an extensible command interface Correct answer.
  3. It is an auxiliary scanner for service enumeration
  4. It is the database schema used to store scan results

Explanation

Meterpreter is a payload that executes in the memory of the target process and offers commands for file, network, and process interaction through extensions. It is not a scanner, database schema, or RPC service.

Question 18Metasploit Framework fundamentals and architecture

A tester wants to run a resource script of console commands automatically at startup. Which approach is correct?

  1. Pass the script with msfconsole -r script.rc Correct answer.
  2. Place the script in the modules directory
  3. Run msfvenom -r script.rc
  4. Set the PAYLOAD option to the script path

Explanation

The -r flag loads a resource script so its commands execute in sequence when the console starts. Resource scripts are plain console command files, not modules or payloads.

Question 19Metasploit Framework fundamentals and architecture

Why might a tester set the LHOST option to an incorrect value when configuring a reverse payload?

  1. The database would reject the session record
  2. The payload would connect back to the wrong host, so no session would reach the tester Correct answer.
  3. The target would refuse to run the exploit module
  4. The encoder would fail to produce shellcode

Explanation

For reverse payloads, LHOST is the address the target connects back to, so an incorrect value directs the connection elsewhere and prevents the handler from receiving a session. It does not affect module execution on the target or database behavior.

Question 20Metasploit Framework fundamentals and architecture

In msfconsole, what is the distinction between a job and a session?

  1. A job is a background module execution, while a session is an established connection to a target Correct answer.
  2. A job is a stored host record, while a session is a saved scan file
  3. A job is a payload, while a session is an encoder
  4. A job is a database table, while a session is a console command

Explanation

Jobs are module instances running in the background, such as a handler waiting for callbacks, and are managed with jobs. Sessions are live connections created when a payload executes on a target.

Question 21Metasploit Framework fundamentals and architecture

A tester runs show payloads after selecting an exploit module. What does the output represent?

  1. The payloads stored in the database
  2. All payloads installed in the Framework
  3. The payloads already used in past sessions
  4. Only the payloads compatible with the selected exploit Correct answer.

Explanation

show payloads is context-sensitive and lists only payloads that the currently selected exploit can deliver, based on its target and architecture constraints. It does not enumerate every payload in the installation.

Question 22Metasploit Framework fundamentals and architecture

A tester sets a value with set and later loads a different module, finding the option blank again. Why did the value not persist?

  1. set stores values only in the database
  2. set requires a session to be active
  3. set writes only to the local module datastore, while setg writes to the global datastore Correct answer.
  4. set clears the option after the module runs

Explanation

The set command scopes a value to the active module, so loading another module does not inherit it. Persisting a value across modules requires setg, which writes to the global datastore.

Question 23Metasploit Framework fundamentals and architecture

An exploit module reports that the PAYLOAD datastore option is missing when run. What is the most likely cause?

  1. RHOSTS was set with setg instead of set
  2. The console is running in quiet mode
  3. The database is not connected
  4. No payload has been selected for the exploit module Correct answer.

Explanation

Exploit modules require a payload to be chosen, typically with set PAYLOAD, before they can run. Without a selected payload the module cannot build the delivery artifact, so it reports the missing option.

Question 24Metasploit Framework fundamentals and architecture

A tester wants to background an exploit already running in the foreground without killing it. Which key sequence accomplishes this in msfconsole?

  1. Ctrl+Z Correct answer.
  2. Ctrl+L
  3. Ctrl+C
  4. Ctrl+D

Explanation

Ctrl+Z suspends the running module and returns to the console prompt, leaving it available as a job. Ctrl+C interrupts and typically terminates the module, while Ctrl+D and Ctrl+L are not used for this purpose.

Question 25Installation, configuration, and console operation

A technician is deploying Microsoft Defender for Endpoint on servers that must not communicate with Microsoft cloud services. Which Defender for Endpoint component should be installed to provide the full protection stack without cloud connectivity?

  1. The Defender for Endpoint security settings management agent
  2. No component can provide the full Defender for Endpoint protection stack without required cloud connectivity Correct answer.
  3. The Microsoft Defender for Endpoint server license key
  4. The Microsoft Defender for Endpoint proxy for Azure ExpressRoute

Explanation

Defender for Endpoint requires connectivity to Microsoft service endpoints for its core capabilities. Installing the endpoint sensor and disabling cloud-delivered protection does not create a complete offline detection-and-response service. Local antivirus functionality is distinct from the full Defender for Endpoint protection stack.

Question 26Installation, configuration, and console operation

An administrator wants to verify that a Windows server has been successfully onboarded to Microsoft Defender for Endpoint. Which console location shows the device after onboarding completes?

  1. Settings > Endpoints > Onboarding in the Microsoft 365 admin center
  2. Azure portal > Microsoft Defender for Cloud > Environment settings
  3. Security & Compliance > Threat management > Quarantine
  4. Assets > Devices in the Microsoft Defender portal Correct answer.

Explanation

After a device is onboarded, it appears in the Microsoft Defender portal under Assets > Devices, where its onboarding status and health can be reviewed. The onboarding page itself only provides the package download and does not list enrolled devices.

Question 27Installation, configuration, and console operation

During onboarding of a Windows Server 2019 device, the administrator must run a script from an elevated command prompt. Which artifact from the Defender portal is used for this manual onboarding method?

  1. The WindowsDefenderATPOnboardingScript.cmd file Correct answer.
  2. The Defender for Endpoint onboarding package for Linux
  3. The Offline Security Intelligence Update package
  4. The onboarding JSON blob only

Explanation

Manual onboarding of Windows servers uses the downloadable script, typically WindowsDefenderATPOnboardingScript.cmd, executed from an elevated command prompt. Running it writes the onboarding configuration into the Defender for Endpoint sensor on the device.

Question 28Installation, configuration, and console operation

A security team needs to automate onboarding of many Windows servers without manually downloading a package per machine. Which approach supports scripted, repeatable onboarding at scale?

  1. Disable tamper protection on each server before onboarding
  2. Rely on automatic onboarding triggered by the first malware detection
  3. Use a Group Policy or management tool to push the onboarding script and settings to target servers Correct answer.
  4. Email the onboarding package to each server owner for manual execution

Explanation

Scripted onboarding at scale is achieved by distributing the onboarding script and configuration through Group Policy, Configuration Manager, or another management tool. This keeps the process repeatable and avoids per-machine manual downloads.

Question 29Installation, configuration, and console operation

An administrator configures the Defender for Endpoint proxy settings for a server that routes internet traffic through an authenticated proxy. Which configuration element is required in addition to the proxy server address?

  1. Credentials for the proxy in the form of a user name and password Correct answer.
  2. A second proxy server for failover
  3. The proxy's public TLS certificate thumbprint
  4. An SMTP relay address

Explanation

When the proxy requires authentication, the Defender for Endpoint proxy configuration must include credentials (user name and password) along with the proxy address. Without valid credentials the sensor cannot reach the cloud service through the authenticated proxy.

Question 30Installation, configuration, and console operation

Which URL category must be allowed through the firewall for a Defender for Endpoint device to report to the service and receive commands?

  1. Only the Microsoft 365 admin center endpoints
  2. The Defender for Endpoint service endpoints for the device's geographic region Correct answer.
  3. Only the Microsoft Update catalog endpoints
  4. Any HTTPS destination, since the sensor uses random hosts

Explanation

Devices must be able to reach the region-specific Defender for Endpoint service endpoints over HTTPS for reporting and command-and-control. Blocking these endpoints prevents the sensor from communicating with the service even if other Microsoft URLs are allowed.

Question 31Installation, configuration, and console operation

A device shows as onboarded but its health state is inactive in the Defender portal. Which action is the most appropriate first troubleshooting step?

  1. Disable the firewall entirely on the server
  2. Delete the device record and re-create the tenant
  3. Verify the device can reach the required Defender for Endpoint service endpoints over HTTPS Correct answer.
  4. Reimage the server and start onboarding again

Explanation

An inactive health state usually indicates the sensor cannot communicate with the service, so confirming connectivity to the required endpoints is the logical first check. Reimaging or disabling the firewall is disproportionate and risks security exposure.

Question 32Installation, configuration, and console operation

Which console capability lets an administrator isolate a compromised device from the network while retaining the Defender for Endpoint connection?

  1. Automated investigation with a full remediation action
  2. Device isolation initiated from the device page Correct answer.
  3. Device tagging with a custom tag
  4. Live response session with limited commands

Explanation

Device isolation is initiated from the device page and blocks most network traffic while preserving the sensor's connection to the service. This allows responders to investigate and take further action remotely.

Question 33Installation, configuration, and console operation

An analyst wants to run a set of built-in commands on a device to gather forensic data without deploying additional tools. Which Defender for Endpoint feature provides this capability?

  1. Live response Correct answer.
  2. Attack surface reduction rules
  3. Advanced hunting queries
  4. Custom detection rules

Explanation

Live response gives analysts a remote shell on the device with a curated set of built-in commands for investigation and remediation. It is designed for interactive forensic collection without installing extra tooling.

Question 34Installation, configuration, and console operation

A security operations team wants to limit which analysts can start a live response session on high-value servers. Which control should be configured?

  1. Role-based access control scoped to the appropriate device groups Correct answer.
  2. Cloud-delivered protection level
  3. Device discovery settings
  4. Automation level for automated investigations

Explanation

Role-based access control determines which users can perform live response and on which device groups, so scoping roles restricts sessions to authorized analysts. Other settings govern detection and automation behavior, not user permissions.

Question 35Installation, configuration, and console operation

An administrator needs to ensure that alerts from a specific set of servers are routed to the security team's ticketing system. Which Defender for Endpoint configuration supports this?

  1. Attack surface reduction audit mode
  2. Alert notification rules and streaming API or SIEM integration Correct answer.
  3. Device group tags applied to the servers
  4. Onboarding package regeneration

Explanation

Alert notification rules send email notifications, while the streaming API or SIEM connector forwards alerts to external systems such as a ticketing platform. Together they support automated routing of alerts.

Question 36Installation, configuration, and console operation

Which setting should be enabled to prevent local administrators from disabling or modifying Defender for Endpoint protections on a server?

  1. Controlled folder access
  2. Network protection
  3. Cloud-delivered protection
  4. Tamper protection Correct answer.

Explanation

Tamper protection blocks changes to security settings such as disabling real-time protection, even by local administrators. It is specifically designed to protect the security configuration from unauthorized modification.

Question 37Installation, configuration, and console operation

A device group in Defender for Endpoint is used to scope which policies and roles apply to a set of servers. Which statement describes how devices are assigned to a device group?

  1. Devices are assigned by the onboarding package filename
  2. Devices are assigned automatically by the operating system version
  3. Devices are assigned by rules based on criteria such as tags, names, or domains, or by manual selection Correct answer.
  4. Devices are assigned only by their IP address range

Explanation

Device groups support rule-based assignment using criteria such as device tags, names, and domains, as well as manual selection. This lets administrators scope policies, automation, and role access to the right set of devices.

Question 38Installation, configuration, and console operation

An analyst wants to review the timeline of events that occurred on a device around the time of an alert. Which Defender for Endpoint view provides this?

  1. The onboarding status report
  2. The security recommendations page
  3. The device timeline on the device page Correct answer.
  4. The software inventory page

Explanation

The device timeline presents a chronological record of events and alerts observed on a device, which helps analysts reconstruct an incident. Other pages list inventory, recommendations, or enrollment status rather than event chronology.

Question 39Installation, configuration, and console operation

An administrator must confirm that a server's sensor is reporting correctly after a policy change. Which indicator in the device inventory reflects whether the device is sending data as expected?

  1. The device tag count
  2. The device group name
  3. The device health state Correct answer.
  4. The last onboarding package version

Explanation

The device health state indicates whether the sensor is active and reporting as expected. A change to inactive or misconfigured signals a communication or configuration problem.

Question 40Installation, configuration, and console operation

A security administrator wants to test a new attack surface reduction rule without blocking user activity. Which mode should be configured?

  1. Audit mode Correct answer.
  2. Block mode
  3. Disabled mode
  4. Warn mode

Explanation

Audit mode evaluates which files or processes would have been affected by an ASR rule and records the event without blocking them. It is the standard way to assess rule impact before enabling block mode.

Question 41Installation, configuration, and console operation

An administrator needs to deploy Defender for Endpoint to Linux servers and verify the service is running after installation. Which command confirms the status of the Defender for Endpoint service on a Linux server?

  1. systemctl status mdatp Correct answer.
  2. net start mdatp
  3. sc query mdatp
  4. Get-Service mdatp

Explanation

On Linux, the Defender for Endpoint service is named mdatp and is managed by systemd, so systemctl status mdatp reports its state. The other commands are Windows tools and do not apply to Linux hosts.

Question 42Installation, configuration, and console operation

A device that was previously onboarded is being retired and must stop sending data to Defender for Endpoint. Which action removes the sensor's onboarding configuration on a Windows device?

  1. Disable the device's network adapter
  2. Run the offboarding script provided in the portal Correct answer.
  3. Delete the device from the device inventory only
  4. Remove the device from its device group

Explanation

Offboarding is performed by running the offboarding script, which removes the onboarding configuration from the sensor so the device stops reporting. Deleting the device record alone does not stop the sensor from sending data.

Question 43Installation, configuration, and console operation

An administrator observes that a newly onboarded server appears in the device inventory but shows no recent security intelligence updates. Which Defender for Endpoint configuration should be checked first?

  1. The alert notification rule recipients
  2. The live response permission level
  3. The device isolation state
  4. The update channel and update source settings for security intelligence Correct answer.

Explanation

Security intelligence updates depend on the configured update channel and source, such as Microsoft Update, WSUS, or a share. If the source is unreachable or misconfigured, the device will not receive new signatures.

Question 44Installation, configuration, and console operation

A security team wants to compare the configuration of many servers against recommended Defender for Endpoint settings. Which console feature provides this comparison?

  1. Security recommendations in the vulnerability management area Correct answer.
  2. The live response command library
  3. The device timeline
  4. The onboarding package generator

Explanation

Security recommendations surface configuration weaknesses and missing mitigations, letting teams compare device posture against recommended settings. They are part of the vulnerability management experience in the Defender portal.

Question 45Information gathering and scanning

During a Metasploit engagement you want to enumerate live hosts on a target subnet without completing the TCP three-way handshake. Which scan type in Metasploit's auxiliary scanner modules best matches this goal?

  1. An FTP bounce scan that relays probes through a target FTP server
  2. A TCP SYN scan that sends SYN packets and interprets SYN/ACK or RST replies Correct answer.
  3. A UDP scan that sends empty datagrams and waits for ICMP unreachable
  4. A full TCP connect scan that completes the handshake on every port

Explanation

A SYN scan (half-open) sends a SYN and classifies the host by whether it receives SYN/ACK or RST, never completing the handshake, which is faster and stealthier. Metasploit's portscan auxiliary modules expose a SCAN type option including SYN, ACK, and connect variants. This is the standard choice for host and port discovery while limiting session state on the target.

Question 46Information gathering and scanning

You run db_nmap against a target and want to see the discovered services stored in the Metasploit database. Which command lists hosts and their associated services from the current workspace?

  1. loot
  2. vulns
  3. hosts -S
  4. services Correct answer.

Explanation

The services command queries the database and prints discovered services with host, port, protocol, and state. The hosts command lists hosts only, while vulns and loot show vulnerabilities and captured data respectively. Using services is the direct way to review scan results stored by db_nmap.

Question 47Information gathering and scanning

Which Metasploit auxiliary module is designed to perform an SMB version and dialect scan against a host to identify the Windows/Samba version?

  1. auxiliary/scanner/smb/smb_enumshares
  2. auxiliary/scanner/smb/smb_login
  3. auxiliary/scanner/smb/smb_version Correct answer.
  4. auxiliary/scanner/smb/smb_ms17_010

Explanation

smb_version negotiates an SMB session and reads the dialect and native OS information to fingerprint the server version. smb_login attempts authentication, smb_enumshares lists shares, and smb_ms17_010 checks for the EternalBlue vulnerability. Version fingerprinting is a distinct information-gathering step from authentication or exploitation checks.

Question 48Information gathering and scanning

In Metasploit, which auxiliary module would you use to gather HTTP server headers, title, and technology hints from a web service without exploiting it?

  1. auxiliary/scanner/http/http_version Correct answer.
  2. auxiliary/scanner/http/http_login
  3. auxiliary/scanner/http/dir_scanner
  4. auxiliary/scanner/http/ssl

Explanation

http_version requests the web root and reports the Server header, response title, and other fingerprinting details. http_login tests credentials, dir_scanner brute-forces directory paths, and ssl inspects certificate details. Header and banner fingerprinting is the information-gathering role of http_version.

Question 49Information gathering and scanning

You need to perform a DNS zone transfer check against a target domain using Metasploit. Which auxiliary module is intended for this?

  1. auxiliary/scanner/discovery/udp_sweep
  2. auxiliary/scanner/dns/dns_amp
  3. auxiliary/gather/enum_dns Correct answer.
  4. auxiliary/gather/dns_bruteforce

Explanation

enum_dns queries a name server for records and can attempt an AXFR zone transfer when the server misconfigures it. dns_amp measures amplification potential, dns_bruteforce guesses hostnames, and udp_sweep discovers UDP services. Zone-transfer enumeration is a DNS information-gathering function handled by enum_dns.

Question 50Information gathering and scanning

Which Metasploit command imports an Nmap XML output file into the current workspace database?

  1. db_import scan.xml Correct answer.
  2. nmap_import scan.xml
  3. db_nmap -iL scan.xml
  4. workspace -a scan.xml

Explanation

db_import parses supported file formats, including Nmap XML, and stores hosts and services in the active workspace. db_nmap runs a live scan rather than importing an existing file, and workspace manages workspaces rather than importing data. Importing preserves results gathered outside Metasploit.