A penetration tester would like to know if any web servers or mail servers are running on the in- scope network segment. Which of the following is the best to use in this scenario?

ARP scans map IP addresses to MAC addresses on a local network segment but do not identify the services running on those hosts.

Website crawling explores the content and structure of an already known web server but does not discover unknown web servers or other service types like mail servers on a network.

DNS lookups resolve hostnames to IP addresses or vice versa, which can help find a server's IP if its hostname is known, but they do not actively scan a network segment to discover unknown servers or their running services.

Nmap probes actively scan target IP addresses for open ports and identify running services, such as HTTP/HTTPS (web servers) or SMTP/IMAP/POP3 (mail servers), by analyzing banner information and service responses. This allows a penetration tester to discover specific server types and their operational status on a network segment.