With the -F, -P, and -U options, what kind of probe scan is performed and on which port?

• A. FIN, PUSH and URG scan on port 80
• B. SYN scan on port 80
• C. ICMP ping scan on subnet 10.0.1.x
• D. ARP ping scan

Answer: (D)

The key idea is host discovery using a link-layer protocol. When those options are used, the scanner performs ARP requests to identify live hosts on the local subnet. ARP operates at the data-link layer and resolves IPs to MAC addresses, so there is no TCP/UDP port involved. If a device on the local network has the requested IP, it replies, confirming it’s up. Because ARP works only within the local broadcast domain, this approach targets the LAN and doesn’t scan a specific port. The other scan types described (FIN/PSH/URG or SYN on a port, or ICMP ping to a subnet) involve TCP flags or IP-level probes and are not what ARP-based host discovery uses.