312-50 Question 66
Single answer▪ Host DiscoveryYou are conducting an internal assessment against a Windows-heavy corporate subnet (10.20.30.0/24). The firewall team tells you that ICMP echo requests are blocked at the perimeter and many endpoints have host-based firewalls that drop unsolicited TCP SYN probes. However, standard Windows systems on this network typically respond to ARP on the local segment. You need the fastest and most reliable way to identify which hosts are up before doing deeper enumeration. Which approach should you use?
- A
Run an ARP sweep on the local subnet, such as with Nmap's -PR host discovery
- B
Run an ICMP echo sweep only, because ping is the standard host discovery method
- C
Run a TCP connect scan (-sT) against port 3389 on every IP, because open ports are required to confirm the host is alive
- D
Run a UDP scan against port 161 on every IP, because UDP is less likely to be filtered than ICMP or TCP
Show answer and explanation
Correct answer: A
Explanation
For IPv4 host discovery on a local subnet, ARP is a best-practice choice because ARP resolution is fundamental to local Layer 2 communication. If a system is active on the LAN, it will usually respond to ARP requests for its address unless specifically configured otherwise. Nmap documentation notes that ARP discovery is used for local Ethernet networks and is often more effective than IP-layer probes such as ICMP, TCP SYN, TCP ACK, or UDP when discovering hosts on the same subnet. In contrast, ICMP echo can be filtered by firewalls, and TCP/UDP-based discovery depends on port states and filtering behavior, making them less reliable for basic up/down determination in this scenario. This question tests the practical CEH skill of selecting the most appropriate host discovery technique based on network position and filtering constraints.
- A. Correct.
Correct. On a local Ethernet/IP subnet, ARP is typically the most reliable and efficient host discovery method because active hosts must answer ARP requests for their IPv4 addresses in order to communicate on the LAN. Nmap's ARP discovery (-PR) is specifically suited for local network host discovery and is often more dependable than ICMP or TCP-based probes when those are filtered. This matches the scenario: same local segment, Windows-heavy environment, and blocked ICMP/SYN-based discovery.
- B. Incorrect.
Incorrect. ICMP echo requests are commonly used for host discovery, but the scenario explicitly states that ICMP echo is blocked. Relying only on ping would miss many live hosts and produce false negatives. A candidate might choose this because ping is the classic discovery tool, but in filtered environments it is not the best option.
- C. Incorrect.
Incorrect. A TCP connect scan can sometimes reveal live hosts, but it is not the fastest or most reliable discovery method in this scenario. The prompt states that many endpoints drop unsolicited TCP SYN probes, and using full TCP connects to a single port like 3389 depends on that port being reachable and listening. Hosts can be alive even if port 3389 is closed or filtered, so this method can miss systems and creates more noise than an ARP sweep on the local subnet.
- D. Incorrect.
Incorrect. UDP scanning is generally slower and less reliable for host discovery because UDP responses are limited and often absent unless the target service is open or an ICMP unreachable is returned. Port 161 may be closed, filtered, or not running on many hosts. A tester might think UDP is less filtered, but in practice UDP-based discovery is often noisier and less dependable than ARP on the same broadcast domain.