Which of the following is NOT essential for understanding network topology during a penetration test?

• A. Interrogating ARP caches, routing tables, and MAC addresses
• B. Mapping subnet addresses and VLANs
• C. Enumerating active devices on the network
• D. Checking social media profiles of admins

Answer: (D)

Understanding network topology during a penetration test relies on uncovering how devices are connected, where traffic flows, and how the network is segmented. Interrogating ARP caches, routing tables, and MAC addresses reveals actual neighbor devices, switch and router relationships, and the paths data takes, which are essential for mapping the live network. Mapping subnet addresses and VLANs shows the IP plan and segmentation, letting you understand which devices belong to which segments and how access is controlled. Enumerating active devices on the network identifies what is present and reachable, highlighting gaps, misconfigurations, or overlooked hosts. Checking social media profiles of admins, while potentially useful for wider security intelligence, does not inform the network’s topology or device inventory, so it isn’t needed for understanding how the network is structured during a test.