An attacker first collects a list of potentially vulnerable machines and then scans them to find vulnerable machines

An attacker first collects a list of potentially vulnerable machines and then scans them to find vulnerable machines

• A. Central Source Propagation
• B. Random Scanning
• C. Permutation Scanning
• D. Hit-list Scanning

Answer: (D)

Targeted vulnerability scanning is what’s being described: the attacker first builds a list of hosts that are likely to be vulnerable and then runs scans only against that set to identify weaknesses. This hit-list approach makes the process efficient, concentrating effort where it’s most likely to pay off and reducing noise and time spent on unreachable or unlikely targets. If you were scanning without a preselected list, you’d be doing random scanning—casting a wide net across many addresses, which is slower, louder, and easier to detect. Permutation scanning changes the order of scanning within a space to avoid patterns, but it still involves scanning a broad range rather than starting from a focused target list. Central Source Propagation refers to how malware spreads from a central node, not to how targets are selected for vulnerability assessment.

Targeted vulnerability scanning is what’s being described: the attacker first builds a list of hosts that are likely to be vulnerable and then runs scans only against that set to identify weaknesses. This hit-list approach makes the process efficient, concentrating effort where it’s most likely to pay off and reducing noise and time spent on unreachable or unlikely targets.

If you were scanning without a preselected list, you’d be doing random scanning—casting a wide net across many addresses, which is slower, louder, and easier to detect. Permutation scanning changes the order of scanning within a space to avoid patterns, but it still involves scanning a broad range rather than starting from a focused target list. Central Source Propagation refers to how malware spreads from a central node, not to how targets are selected for vulnerability assessment.