PT0-002 Practice Question: ff02::1 is the IPv6 all-nodes multicast address.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Perform a full TCP SYN scan on the entire /64 subnet using Nmap with IPv6 addressing

  Why it's wrong here

  Performing a full TCP SYN scan on an entire /64 IPv6 subnet via Nmap is computationally impractical: the address space comprises 2^64 (about 18.4 quintillion) addresses. Even at an aggressive 10,000 packets per second, completing a single SYN sweep would take over 58 million years, and the resulting traffic would likely trigger network defenses. IPv6 was intentionally designed with a vast address space to render brute-force scanning infeasible, so this approach is not a viable internal reconnaissance technique.

• ✓

  Ping the IPv6 all-nodes multicast address (ff02::1) and analyze the responses to discover active hosts

  Why this is correct

  Sending an ICMPv6 echo request to the link-local all-nodes multicast address ff02::1 is an efficient active discovery method because every IPv6 host must join the ff02::1 group on its interface. When a host receives the multicast ping, it replies with its link-local address, allowing the tester to quickly enumerate active nodes on the segment. This technique is analogous to IPv4 broadcast ping but is more precise in IPv6, though some firewalls may suppress echo replies, and the results are limited to the local link.

• ✗

  Request the DHCPv6 server log from the network administrator to obtain a list of assigned IPv6 addresses

  Why it's wrong here

  Requesting DHCPv6 server logs from the network administrator is not a direct penetration testing technique; it depends entirely on third-party cooperation and may be unavailable or incomplete. DHCPv6 logs only list addresses assigned via stateful DHCPv6, missing hosts configured with static addresses or using SLAAC (Stateless Address Autoconfiguration). In an internal reconnaissance context, an active discovery method is preferred because it does not rely on external cooperation and provides a more current, attacker-centric view of the network.

• ✗

  Use the `ip neighbor` command on the tester's machine to view the IPv6 neighbor cache after generating traffic

  Why it's wrong here

  Running `ip neighbor` only displays the IPv6 neighbor cache, which contains entries for hosts the machine has recently exchanged traffic with; it does not actively probe the network. To populate this cache, the tester must first generate traffic to specific addresses—such as through ping or TCP connections—which requires prior knowledge of targets. As a result, this command is a passive observation tool for reviewing existing communication patterns, not a standalone host discovery technique.

Go deeper

Related to this question