312-50 Question 59
Single answer▪ Network Scanning ConceptsDuring an authorized internal assessment, you need to identify live hosts across a subnet while generating as little noise as possible. A previous ICMP echo sweep returned almost no results because the environment blocks ICMP at the perimeter and on many endpoints. You know the target network is a local Ethernet segment, and you want the most reliable discovery method before performing deeper port scans. Which technique should you use?
- A
Perform an ARP scan on the local subnet
- B
Run a TCP connect scan against port 80 on every address
- C
Use an ICMP timestamp request sweep instead of echo requests
- D
Launch a UDP scan against port 53 on every host
Show answer and explanation
Correct answer: A
Explanation
For host discovery on a local broadcast domain, ARP scanning is a best-practice choice because ARP operates at Layer 2 and is fundamental to communication on IPv4 Ethernet networks. In practice, scanners such as Nmap prefer ARP requests for targets on the same local subnet because ARP responses are typically available even when ICMP-based discovery fails. TCP connect and UDP scans are more appropriate for service enumeration after host discovery, but they create more noise and depend on service behavior. ICMP alternatives such as timestamp requests are not a dependable workaround in environments where ICMP is intentionally filtered. This aligns with common network scanning methodology: first use the most reliable discovery technique for the network context, then proceed to targeted port scanning.
- A. Correct.
Correct. On a local Ethernet network, ARP-based host discovery is highly reliable because ARP is required for resolving Layer 3 addresses to Layer 2 MAC addresses on the local segment. Even if ICMP is filtered by host firewalls or network devices, systems on the same subnet typically still respond to ARP requests unless they are offline or specially configured. Tools such as Nmap commonly use ARP discovery for local networks for this reason.
- B. Incorrect.
Incorrect. A TCP connect scan can identify hosts if a probed port is open or sometimes closed, but it is noisier and less efficient for initial host discovery. It also depends on the selected port being reachable and may trigger logging on endpoints and services. For live-host identification on a local subnet, ARP is more reliable and less dependent on application-layer services.
- C. Incorrect.
Incorrect. ICMP timestamp requests may be filtered just like ICMP echo requests, and many modern systems either block or ignore them. Switching ICMP message types does not solve the core issue when ICMP is broadly restricted. This option reflects the misconception that any ICMP type will bypass filtering.
- D. Incorrect.
Incorrect. UDP scanning is generally slower and less reliable for host discovery because lack of response is ambiguous; open UDP ports often remain silent, and closed ports may send ICMP port unreachable messages that are rate-limited or filtered. Using UDP against port 53 on every host is also impractical because many hosts will not be running DNS services.