A penetration tester performing an internal network assessment needs to identify live hosts on the 10.0.0.0/8 network while minimizing IDS detection. Which scanning approach is MOST appropriate?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — b is correct because low-rate randomized scanning avoids the high-rate sequential patterns that IDS rules and anomaly detection systems recognize as port scans. ICMP and ARP are also less suspicious than TCP SYN scans in many environments.
Full Explanation
B is correct because low-rate randomized scanning avoids the high-rate sequential patterns that IDS rules and anomaly detection systems recognize as port scans. ICMP and ARP are also less suspicious than TCP SYN scans in many environments. A is wrong because maximum-speed full-range scanning produces easily detected high-rate anomalies. C is wrong because UDP scanning all ports on all hosts simultaneously is extremely noisy. D is wrong because SYN flooding is a denial-of-service technique, not a valid reconnaissance method, and is clearly detectable.