Andrew is an Ethical Hacker who was assigned the task of discovering all the active devices hidden by a restrictive firewall in the IPv4 range in a given target network. Which of the following host…

Question

Options

• AUDP scan
• BARP ping scan
• CACK flag probe scan
• DTCP Maimon scan

• A
  9% (3)
• B
  71% (24)
• C
  18% (6)
• D
  3% (1)

Explanation

ARP Ping Scan for Local Network Host Discovery

Why B is Correct: ARP (Address Resolution Protocol) ping scan is the most effective technique for discovering active hosts on a local IPv4 network, even when a restrictive firewall is in place. Since ARP operates at Layer 2 (Data Link layer), it bypasses firewall rules that filter Layer 3/4 traffic - firewalls cannot block ARP requests on the same subnet, making it highly reliable for discovering all live hosts.

Why the Others Are Wrong:

• A (UDP Scan): UDP scans are used for detecting open UDP ports on known hosts, not for host discovery - they are also slow and easily blocked by firewalls.
• C (ACK Flag Probe Scan): This technique is used for firewall rule mapping and determining whether ports are filtered/unfiltered, not for discovering hidden hosts.
• D (TCP Maimon Scan): This is a stealthy port scanning technique (sends FIN/ACK probes) used to bypass certain firewalls during port scanning, not for general host discovery.

Memory Tip: Think "ARP = Address on your street" - ARP works locally (same network/subnet) and cannot be blocked by firewalls because it's a Layer 2 protocol. If a device is on your network, ARP will find it. When the question mentions IPv4 range + restrictive firewall + local network, always think ARP ping scan.

No community discussion yet for this question.