A penetration tester performing an internal network assessment needs to identify live hosts on the 10.0.0.0/8 network while minimizing IDS detection. Which scanning approach is MOST appropriate?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because low-rate randomized scanning avoids the high-rate sequential patterns that IDS rules and anomaly detection systems recognize as port scans. ICMP and ARP are also less suspicious than TCP SYN scans in many environments.
Full explanation below image
Full Explanation
B is correct because low-rate randomized scanning avoids the high-rate sequential patterns that IDS rules and anomaly detection systems recognize as port scans. ICMP and ARP are also less suspicious than TCP SYN scans in many environments. A is wrong because maximum-speed full-range scanning produces easily detected high-rate anomalies. C is wrong because UDP scanning all ports on all hosts simultaneously is extremely noisy. D is wrong because SYN flooding is a denial-of-service technique, not a valid reconnaissance method, and is clearly detectable.