A vulnerability scan identifies that an SSL certificate does not match the hostname; however, the client disputes the finding. Which of the following techniques can the penetration tester perform to…

When a vulnerability scanner checks whether an SSL certificate's Common Name or Subject Alternative Names match the target hostname, it performs a DNS lookup to resolve the hostname and compare it against the certificate fields. If outbound DNS requests are blocked or misconfigured, the scanner cannot resolve hostnames correctly, which can produce false positives or false negatives on hostname mismatch findings - confirming DNS is reachable validates the result.

ARP resolution operates at Layer 2 to resolve IP addresses to MAC addresses on a local network segment and has no bearing on SSL certificate hostname matching.

Configuring the scanner to analyze IP hosts relates to how targets are enumerated by IP, not to validating DNS-based hostname fields embedded in SSL certificates.

While scanner plug-ins enable specific checks, the root cause of a disputed hostname mismatch finding is DNS resolution capability, not missing plug-ins.