easyMultiple ChoiceObjective-mapped
CISSP Practice Question: A security assessor is conducting a penetration…
A security assessor is conducting a penetration test and needs to identify live hosts on a network without causing disruption. Which of the following techniques should the assessor use FIRST?
⚠ Common exam trap
Test-takers frequently choose 'ARP scan' (Option A) thinking it is the least disruptive, but they forget that ARP is limited to the local broadcast domain and cannot discover hosts across routers, making it ineffective for a penetration test that typically spans multiple subnets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ping sweep using ICMP echo requests.
A ping sweep using ICMP echo requests (ICMP Type 8) is the most appropriate first step for identifying live hosts on a network because it is a standard, low-disruption method that quickly determines host availability. ICMP echo requests are typically allowed by default on many networks and do not initiate full protocol handshakes or service interactions, minimizing the risk of triggering alarms or causing instability. This aligns with the penetration testing methodology of starting with passive or low-impact reconnaissance before escalating to more intrusive techniques.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ARP scan to discover hosts on the local subnet.
Why it's wrong here
An ARP (Address Resolution Protocol) scan is effective for discovering live hosts only within the local broadcast domain or subnet. It operates at Layer 2 of the OSI model, mapping IP addresses to MAC addresses. While efficient for local discovery, it cannot traverse routers to identify hosts on remote subnets, making it unsuitable for comprehensive host discovery across an entire target range that likely spans multiple network segments.
- ✓
Ping sweep using ICMP echo requests.
Why this is correct
A ping sweep utilizes ICMP (Internet Control Message Protocol) echo requests to determine which IP addresses within a specified range correspond to active hosts. By sending an ICMP echo request to each IP and awaiting an echo reply, the assessor can efficiently identify live systems. This method is a foundational and relatively non-intrusive technique for initial host discovery, providing a quick overview of reachable devices before proceeding to more detailed reconnaissance.
- ✗
Vulnerability scan of all IP addresses in the target range.
Why it's wrong here
Conducting a vulnerability scan across an entire IP range without prior host discovery is highly inefficient and resource-intensive. Vulnerability scanners attempt to identify security weaknesses on active systems, and scanning non-existent IP addresses wastes significant time and network bandwidth. The standard methodology dictates first identifying live hosts through simpler methods, then focusing the more complex and time-consuming vulnerability scans only on those confirmed active targets.
- ✗
Full TCP port scan on common ports.
Why it's wrong here
Performing a full TCP port scan, even on common ports, is a more intrusive and time-consuming activity than initial host discovery. Its primary purpose is to identify open services and applications running on known live hosts, not to determine if a host is alive in the first place. Initiating a port scan across an entire range of potential IP addresses before confirming host existence would generate excessive network traffic and unnecessary alerts, making it an inappropriate first step in reconnaissance.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.