nerdexam
EC-Council

312-50V13 · Question #368

What is the least important information when you analyze a public IP address in a security alert?

The correct answer is D. ARP. When analyzing a public IP address in a security alert, ARP is the least important information because it is a local network protocol, unlike DNS, Whois, and Geolocation which provide global context.

Submitted by obi.ng· Mar 6, 2026Footprinting and Reconnaissance

Question

What is the least important information when you analyze a public IP address in a security alert?

Options

  • ADNS
  • BWhois
  • CGeolocation
  • DARP

How the community answered

(16 responses)
  • A
    6% (1)
  • B
    6% (1)
  • D
    88% (14)

Why each option

When analyzing a public IP address in a security alert, ARP is the least important information because it is a local network protocol, unlike DNS, Whois, and Geolocation which provide global context.

ADNS

DNS (Domain Name System) resolution is crucial for identifying hostnames associated with the public IP, which can reveal information about the server's purpose or reputation.

BWhois

Whois records provide registration details for the public IP address block, including ownership, contact information, and abuse reporting, which is vital for attribution and response.

CGeolocation

Geolocation helps determine the physical location of the public IP address, offering geographical context that can be important for threat intelligence and policy enforcement.

DARPCorrect

ARP (Address Resolution Protocol) is a Layer 2 protocol used to map IP addresses to MAC addresses within a local broadcast domain, making it irrelevant for analyzing a public IP address on the internet.

Concept tested: IP address analysis tools

Source: https://learn.microsoft.com/en-us/windows-server/networking/technologies/ip-address-management/what-is-ipam

Topics

#IP address analysis#Whois#DNS lookup#Geolocation

Community Discussion

No community discussion yet for this question.

Full 312-50V13 Practice