DNS Scan aka List Scan: Which scan is used to list IPs for all listed subnets on the command line?

• A. -sN
• B. -sI
• C. -sA
• D. -sL

Answer: (D)

List Scan is the mode that expands every target you specify into individual IP addresses and prints them without sending any packets. That’s why it’s used to list all the IPs within the subnets you provide on the command line. It effectively reveals what would be scanned, without performing any probing. You can opt to show hostnames by enabling DNS resolution (for example with reverse DNS) or keep just the IPs by disabling resolution. In contrast, the other scan types actually send probes to discover open ports or map firewall rules, rather than just listing targets. For example, one of them sends a TCP packet with no flags, another uses a zombie host to perform probing, and another checks firewall behavior by sending ACK packets. So the option that lists every target address from the given subnets without scanning is the List Scan.