A network administrator reviews logs and observes that an attacker sends packets requesting the target...

The correct answer is D. ICMP Timestamp Ping Scan.

An ICMP Timestamp Ping Scan uses ICMP timestamp request messages to query a target system’s clock value. If the target responds, the returned timestamp information can confirm that the host is alive and can also help infer timing characteristics such as round-trip delay.

CEH scanning material explains that ICMP scanning is used to identify live hosts by sending ICMP requests and observing replies. ICMP echo replies verify that a host is live, and ICMP-based discovery can also help determine network behavior and host characteristics .

Option A. UDP Ping Scan is incorrect because UDP scanning uses UDP probes, not ICMP timestamp requests.

Option B. ICMP Echo Ping Sweep is incorrect because echo ping sweeps use ICMP Echo Request and Echo Reply, not timestamp request/reply.

Option C. IP Protocol Scan is incorrect because IP protocol scanning tests supported IP protocols rather than querying clock values.

Option D. ICMP Timestamp Ping Scan is correct because the packet requests the target’s internal clock value.

Therefore, the best answer is D. ICMP Timestamp Ping Scan.