Which endpoint classification method requires direct device interrogation for identification?

Question

Options

• ADHCP lease duration
• BPassive profiling
• CStatic VLAN tagging
• DActive profiling

• A
  2% (1)
• B
  4% (2)
• C
  2% (1)
• D
  93% (52)

Explanation

Active profiling (D) is correct because it works by directly interrogating - or "probing" - network devices using techniques like Nmap scans, SNMP queries, or WMI calls to gather endpoint information in real time, requiring active communication with the target device.

Why the distractors are wrong:

• A (DHCP lease duration): This is a passive observation technique; it reads existing DHCP traffic without probing devices directly.
• B (Passive profiling): By definition, passive profiling listens to existing network traffic (DHCP fingerprints, NetFlow, etc.) without sending any packets to endpoints.
• C (Static VLAN tagging): This is a network segmentation/assignment method based on port or MAC address - it doesn't identify or interrogate devices at all.

Memory tip: Think of Active profiling = Asking. It asks the device directly ("Hey, what are you?"), while passive profiling silently eavesdrops on existing conversations. If it sends a packet to the endpoint, it's active.

No community discussion yet for this question.