What kind of ICMP message can be used by threat actors to perform network reconnaissance and scanning attacks?

What kind of ICMP message can be used by threat actors to perform network reconnaissance and scanning attacks?

• ICMP mask reply
• ICMP router discovery
• ICMP unreachable
• ICMP redirects

Explanation: Common ICMP messages of interest to threat actors include the these:
ICMP echo request and echo reply: used to perform host verification and DoS attacks
ICMP unreachable: used to perform network reconnaissance and scanning attacks
ICMP mask reply: used to map an internal IP network
ICMP redirects: used to lure a target host into sending all traffic through a compromised device and create a man-in-the-middle attack
ICMP router discovery: used to inject bogus route entries into the routing table of a target host

Exam with this question: CyberOps Associate (Version 1.0) - CyberOps Associate 1.0 Practice Final exam