A city network team wants host discovery on an approved /24 before deep port scans. Which approach best fits rules of engagement while reducing unnecessary noise?
Select an answer to reveal the explanation.
Short Explanation
Host discovery is like knocking on doors before you inventory every room. Find which addresses actually answer, then spend the loud, thorough scans there. Blasting empty IPs just makes noise and burns the engagement clock.
Full Explanation
For host discovery on an approved city /24, identify live hosts first with approved discovery methods, then concentrate deeper port scanning on responsive addresses. That approach fits rules of engagement while reducing unnecessary noise against unused addresses. Immediately full-port TCP connect scanning every address increases load and alert volume without proportional early value. Skipping discovery to spray credentials at broadcast addresses is both noisy and methodologically wrong. Scanning only the gateway and DHCP server because 'other hosts are offline' invents a false assumption common on civic networks with quiet endpoints. Exam caveat: discovery technique itself must stay within RoE timing and protocol limits, especially near fragile segments. Operational check: run authorized ping/ARP/TCP-ACK style discovery as allowed, build a live-host list, then schedule deeper scans against that list while watching municipal SOC feedback for excessive noise. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services.