A hospital placed 300 unmanaged infusion pumps and label printers on a monitoring VLAN. They get static addresses, ignore SNMP queries, send no web traffic, and skip 802.1X, yet each model exposes a different set of open TCP ports. Which probe should supply the profiling attributes for these devices?
Select an answer to reveal the explanation.
Short Explanation
With static addresses and no SNMP replies or web traffic, you can’t rely on those probes to profile the devices. The NMAP probe scans TCP ports and supplies open-port attributes, giving profiling rules a fingerprint to match each device type.
Full Explanation
NMAP is the appropriate probe because it actively scans TCP ports and supplies open-port attributes that distinguish these devices for profiling. Each model exposes a different set of open TCP ports, so the probe must discover reachable ports rather than infer only a broader device identity. A DHCP fingerprint probe classifies clients from vendor-class identifiers and requested option values, but it depends on observing DHCP exchanges; these devices use static addresses, so that evidence is absent. Passive TCP/IP stack fingerprinting can infer an operating-system or device family from characteristics of packets the devices send, but it does not actively enumerate listening ports and may not distinguish models whose port sets differ. A MAC OUI lookup maps a hardware address prefix to a registered manufacturer, but generally identifies a vendor, not the model-specific open-port attributes required here. Exam caveat: “passive” describes how evidence is collected; it does not mean the method can supply every attribute an active scan can. Practical check: confirm the profiling system’s NMAP probe can reach the VLAN’s TCP services and that scanning is permitted and appropriately rate-limited for the infusion pumps and printers.