CEH Footprinting and Reconnaissance — 10 Questions

Question 1

A penetration tester is performing a footprinting exercise on a target company. The tester wants to identify the network range and ISP of the target. Which of the following tools or techniques is MOST appropriate for this purpose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform a WHOIS lookup against the domain. A WHOIS lookup is a fundamental technique for gathering registration information about Internet resources. While a direct WHOIS lookup on a domain provides details about the domain registrant and registrar, it often also reveals the hosting provider or name servers, which are crucial for identifying the target's ISP. To obtain the precise network range (e.g., CIDR block) and the organization (ISP) responsible for the IP addresses used by the target, a penetration tester would typically first resolve the domain to an IP address and then conduct a WHOIS lookup on that IP address. This overall process, initiated by querying the domain, leverages WHOIS to gather the required authoritative registration data.

Answer

Query the Netcraft site for the domain

Answer

Use nslookup to query the authoritative name servers

Answer

Run a traceroute to the target web server

Question 2

During footprinting, a tester finds that the target's DNS server allows recursive queries from the internet. What is the MOST significant security implication of this finding?

Accepted Answer

The DNS server can be used for denial of service. A DNS server that allows recursive queries from the internet can be exploited in a DNS amplification attack, a type of denial-of-service (DoS) attack. The attacker sends a small query with a spoofed source IP (the victim's IP) to the open recursive resolver, which responds with a much larger response (e.g., using the ANY record type), amplifying traffic up to 50-100 times. This floods the victim's network, making the DNS server an unwitting participant in the attack.

Answer

Unauthorized zone transfers are possible

Answer

The DNS server can be used for denial of service (amplification)

Answer

The DNS cache can be poisoned easily

Question 3

During a penetration test, you are tasked with performing footprinting on a target organization. You have identified the target's IP range 192.168.1.0/24. Which of the following techniques would provide the most comprehensive information about the target's network topology and potential entry points?

Accepted Answer

Use traceroute to map the network path and identify intermediate routers and firewalls.. The explanation correctly describes what traceroute does (revealing Layer 3 path and hops), but it fails to address the fundamental issue of tracerouting to a private IP range from an external perspective. Therefore, while traceroute is conceptually the best technique for mapping network topology among the options, it's not applicable in the scenario as described.

Answer

Conduct social engineering to gather information from employees about internal network structure.

Answer

Perform a WHOIS lookup to obtain domain registration details including administrative contacts.

Answer

Perform DNS enumeration to find all subdomains and associated IP addresses.

Question 4

Which TWO of the following tools are commonly used for passive reconnaissance?

Accepted Answer

theHarvester. theHarvester is a passive reconnaissance tool that gathers information from public sources such as search engines (Google, Bing), PGP key servers, and the Shodan API without directly interacting with the target network. It collects email addresses, subdomains, IPs, and employee names by querying publicly available data, making it a purely passive technique. Shodan is also considered a passive reconnaissance tool because it acts as a search engine for Internet-connected devices. When an attacker queries Shodan, they are accessing information that Shodan has already collected through its own active scanning, rather than directly sending packets to the target system. This indirect method of information gathering makes it passive from the attacker's perspective regarding the target.

Answer

nmap

Answer

Netcat

Answer

Metasploit

Question 5

During the reconnaissance phase, a tester discovers that the target company's email server is configured to automatically respond to delivery status notifications (DSNs). Which type of attack could this information facilitate?

Accepted Answer

Email enumeration. Email servers that automatically respond to Delivery Status Notifications (DSNs) as defined in RFC 1891/3464 can be exploited for email enumeration. By sending a message to a non-existent address, the DSN response will indicate the address is invalid, while a valid address may generate no DSN or a different response. This allows an attacker to systematically verify valid email addresses on the target domain without triggering a full bounce-back to the original sender.

Answer

DNS cache poisoning

Answer

Man-in-the-middle attack

Answer

Phishing attack

Question 6

A security analyst is tasked with performing passive reconnaissance on a target organization. Which of the following is the BEST approach to gather information about the target's technology stack without directly interacting with the target's systems?

Accepted Answer

Use Shodan to search for target infrastructure. Shodan is a search engine that indexes banners from internet-connected devices, allowing an analyst to discover a target's exposed services, open ports, and technology stack (e.g., web servers, SSH versions, IoT devices) without sending any packets to the target's systems. This makes it a purely passive reconnaissance technique, as it relies on Shodan's pre-collected data rather than direct interaction.

Answer

Engage in social engineering via phone calls

Answer

Initiate a DNS zone transfer request

Answer

Perform a port scan with Nmap

Question 7

An ethical hacker wants to discover subdomains of a target domain using only public information. Which of the following techniques is MOST effective?

Accepted Answer

Use the site: operator in search engines. The `site:` operator in search engines (e.g., Google) allows an ethical hacker to enumerate publicly indexed subdomains of a target domain by querying `site:*.targetdomain.com`. This technique leverages the search engine's crawl data to discover subdomains that are publicly accessible but may not be linked from the main site, making it the most effective method for passive, public-information-only reconnaissance.

Answer

Run a traceroute to the main domain

Answer

Check the WHOIS record for the domain

Answer

Perform a reverse DNS lookup on the target IP range

Question 8

Which TWO of the following are examples of passive footprinting techniques? (Select exactly 2.)

Accepted Answer

Using Google dorking to find exposed documents. Google dorking involves using advanced search operators (e.g., filetype:, intitle:) to discover publicly accessible information without directly interacting with the target's systems. This is a passive footprinting technique as it relies on publicly indexed data from search engines, not on sending packets to the target's network.

Answer

Performing a ping sweep on the target network

Answer

Conducting a port scan with Nmap

Answer

Brute forcing subdomains via DNS queries

Question 9

Which THREE of the following are valid pieces of information that can be gathered from a properly configured Netcraft site report? (Select exactly 3.)

Accepted Answer

Hosting provider and country. Netcraft site reports are derived from external, public-facing data sources, including DNS records, HTTP response headers, and historical crawl data. The hosting provider and country are identified by mapping the site's public IP address to WHOIS and BGP routing information, which is a standard part of Netcraft's passive reconnaissance.

Answer

Internal IP addresses of the servers

Answer

Employee email addresses

Question 10

An ethical hacker runs the command shown in the exhibit. Which of the following conclusions can be drawn from the output?

Accepted Answer

The domain has two mail exchange servers. The output shows two MX records for the domain, each with a preference value (10 and 20). MX records specify mail exchange servers, and the presence of two distinct entries indicates the domain has two mail exchange servers. The lower preference value (10) is the primary server, and the higher value (20) is a secondary or backup server.

Answer

The DNS server is configured to block zone transfers

Answer

Mail is automatically forwarded to a backup server

Answer

The domain has an SPF record configured