The infected machine looks for new vulnerable machines in its own local network

• A. Topological Scanning
• B. Local Subnet Scanning
• C. Hit-list Scanning
• D. Random Scanning

Answer: (B)

Malware propagation within a local network relies on scanning the addresses of hosts that share the same subnet to find vulnerable machines and spread quickly. By looking only at the local subnet (the IP range defined by the infected host’s network mask), the worm can reach nearby devices with minimal delay and network traffic, and with a high chance of similar configurations and services being present. This targeted local scanning is more efficient for spreading inside a LAN than casting wide, random searches across the internet or relying on a precompiled list of targets. The behavior described fits local subnet scanning best because the search is confined to the infected machine’s own network segment.