Which action demonstrates the MOST effective use of a script during the enumeration phase of a penetration test?

• A. A script that floods the network with traffic.
• B. Developing a script to parse Nmap output and alert when host count deviates from scope.
• C. A script that automatically exploits identified hosts.
• D. A script that generates a final report after testing.

Answer: (B)

During enumeration, automation should keep data collection accurate, repeatable, and aligned with the engagement scope. A script that parses the output of a scanning tool like Nmap and immediately alerts when the number of discovered hosts deviates from the defined scope exemplifies this approach. It provides real-time feedback on scope drift, helping you stay focused on the intended targets, reduces manual tallying, and speeds up triage by flagging unexpected results. This use of scripting enhances efficiency and governance during the enumeration phase.

Flooding the network with traffic is disruptive and not aligned with enumeration goals; it risks service impact and violates typical engagement rules. Automatically exploiting identified hosts pushes into the exploitation phase, not enumeration, and is inappropriate for this stage. Generating a final report after testing is a post-enumeration activity and doesn’t illustrate how scripting improves data collection and scope management during enumeration itself.