Certified Ethical Hacker (CEH v11) — Question 258

What is the least important information when you analyze a public IP address in a security alert?

Answer options

• A. DNS
• B. Whois
• C. Geolocation
• D. ARP

Correct answer: D

Explanation

ARP (Address Resolution Protocol) is primarily used for mapping IP addresses to MAC addresses within a local network, making it less relevant for analyzing a public IP address in a security alert. In contrast, DNS, Whois, and Geolocation provide valuable context and information about the ownership and location of the public IP, making them more important in this scenario.