CEH Footprinting and Reconnaissance Practice Test 1 — 15 Questions

Question 1

A penetration tester is performing a footprinting exercise on a target company. The tester wants to identify the network range and ISP of the target. Which of the following tools or techniques is MOST appropriate for this purpose?

Accepted Answer

Perform a WHOIS lookup against the domain. A WHOIS lookup against the target domain returns registration details that include the organization's network range (via the 'NetRange' or 'CIDR' fields) and the ISP (via the 'OrgName' or 'descr' fields). This directly maps to the footprinting goal of identifying the target's IP address block and upstream provider, as defined in RFC 3912 and common WHOIS database schemas.

Answer

Query the Netcraft site for the domain

Answer

Use nslookup to query the authoritative name servers

Answer

Run a traceroute to the target web server

Question 2

During the reconnaissance phase, a tester discovers that the target company's email server is configured to automatically respond to delivery status notifications (DSNs). Which type of attack could this information facilitate?

Accepted Answer

Email enumeration. Email servers that automatically respond to Delivery Status Notifications (DSNs) as defined in RFC 1891/3464 can be exploited for email enumeration. By sending a message to a non-existent address, the DSN response will indicate the address is invalid, while a valid address may generate no DSN or a different response. This allows an attacker to systematically verify valid email addresses on the target domain without triggering a full bounce-back to the original sender.

Answer

DNS cache poisoning

Answer

Man-in-the-middle attack

Answer

Phishing attack

Question 3

A security analyst is tasked with performing passive reconnaissance on a target organization. Which of the following is the BEST approach to gather information about the target's technology stack without directly interacting with the target's systems?

Accepted Answer

Use Shodan to search for target infrastructure. Shodan is a search engine that indexes banners from internet-connected devices, allowing an analyst to discover a target's exposed services, open ports, and technology stack (e.g., web servers, SSH versions, IoT devices) without sending any packets to the target's systems. This makes it a purely passive reconnaissance technique, as it relies on Shodan's pre-collected data rather than direct interaction.

Answer

Engage in social engineering via phone calls

Answer

Initiate a DNS zone transfer request

Answer

Perform a port scan with Nmap

Question 4

An ethical hacker wants to discover subdomains of a target domain using only public information. Which of the following techniques is MOST effective?

Accepted Answer

Use the site: operator in search engines. The `site:` operator in search engines (e.g., Google) allows an ethical hacker to enumerate publicly indexed subdomains of a target domain by querying `site:*.targetdomain.com`. This technique leverages the search engine's crawl data to discover subdomains that are publicly accessible but may not be linked from the main site, making it the most effective method for passive, public-information-only reconnaissance.

Answer

Run a traceroute to the main domain

Answer

Check the WHOIS record for the domain

Answer

Perform a reverse DNS lookup on the target IP range

Question 5

During footprinting, a tester finds that the target's DNS server allows recursive queries from the internet. What is the MOST significant security implication of this finding?

Accepted Answer

The DNS server can be used for denial of service. Option D is correct because a DNS server that allows recursive queries from the internet can be exploited in a DNS amplification attack, a type of denial-of-service (DoS) attack. The attacker sends a small query with a spoofed source IP (the victim's IP) to the open recursive resolver, which responds with a much larger response (e.g., using the ANY record type), amplifying traffic up to 50-100 times. This floods the victim's network, making the DNS server an unwitting participant in the attack.

Answer

Unauthorized zone transfers are possible

Answer

The DNS server can be used for denial of service (amplification)

Answer

The DNS cache can be poisoned easily

Question 6

Which TWO of the following are examples of passive footprinting techniques? (Select exactly 2.)

Accepted Answer

Using Google dorking to find exposed documents. Option C is correct because Google dorking involves using advanced search operators (e.g., filetype:, intitle:) to discover publicly accessible information without directly interacting with the target's systems. This is a passive footprinting technique as it relies on publicly indexed data from search engines, not on sending packets to the target's network.

Answer

Performing a ping sweep on the target network

Answer

Conducting a port scan with Nmap

Answer

Brute forcing subdomains via DNS queries

Question 7

Which THREE of the following are valid pieces of information that can be gathered from a properly configured Netcraft site report? (Select exactly 3.)

Accepted Answer

Hosting provider and country. Netcraft site reports are derived from external, public-facing data sources, including DNS records, HTTP response headers, and historical crawl data. The hosting provider and country are identified by mapping the site's public IP address to WHOIS and BGP routing information, which is a standard part of Netcraft's passive reconnaissance.

Answer

Internal IP addresses of the servers

Answer

Employee email addresses

Question 8

An ethical hacker runs the command shown in the exhibit. Which of the following conclusions can be drawn from the output?

Accepted Answer

The domain has two mail exchange servers. The output shows two MX records for the domain, each with a preference value (10 and 20). MX records specify mail exchange servers, and the presence of two distinct entries indicates the domain has two mail exchange servers. The lower preference value (10) is the primary server, and the higher value (20) is a secondary or backup server.

Answer

The DNS server is configured to block zone transfers

Answer

Mail is automatically forwarded to a backup server

Answer

The domain has an SPF record configured

Question 9

You are a penetration tester hired to perform a security assessment for a medium-sized e-commerce company, "ShopSmart". The company hosts its website on a shared hosting environment and uses a third-party payment gateway. Your goal is to gather as much information as possible without triggering any alarms. During the initial footprinting, you discover that the company's domain "shopsmart.com" was registered five years ago and the WHOIS record shows the registrant's name, address, phone number, and email. The email address is "admin@shopsmart.com". You also find a job posting on LinkedIn that mentions they are looking for a "Senior PHP Developer with experience in Laravel and MySQL". Additionally, by using the Wayback Machine, you find an old version of the site that includes a comment in the HTML source: "". You attempt to access /dev/test.php but receive a 404 error. What should you do NEXT to maximize information gain while remaining passive?

Accepted Answer

Use Google dorking with site:shopsmart.com and filetype:php to find cached or indexed pages. Option A is correct because Google dorking with `site:shopsmart.com filetype:php` is a passive reconnaissance technique that leverages cached or indexed pages in Google’s search engine. This can reveal the old `/dev/test.php` page or other PHP files that may still be accessible via cached content, even if the live server returns a 404. It maximizes information gain without sending any direct traffic to the target, thus avoiding alarms.

Answer

Run a whois lookup on the IP address of the shared host

Answer

Try common file extensions for the debug page: test.asp, test.aspx, test.jsp

Answer

Perform a DNS brute force to find subdomains

Question 10

During a penetration test, you are tasked with performing footprinting on a target organization. You have identified the target's IP range 192.168.1.0/24. Which of the following techniques would provide the most comprehensive information about the target's network topology and potential entry points?

Accepted Answer

Use traceroute to map the network path and identify intermediate routers and firewalls.. Traceroute (using ICMP, UDP, or TCP probes with incrementing TTL values) reveals the Layer 3 path from the tester to the target, identifying each hop (router, firewall, or other gateway) along the route. This directly maps the network topology and can expose intermediate security devices, ACLs, and potential choke points, which is the most comprehensive technique for understanding the target's network layout and entry points from the given options.

Answer

Conduct social engineering to gather information from employees about internal network structure.

Answer

Perform a WHOIS lookup to obtain domain registration details including administrative contacts.

Answer

Perform DNS enumeration to find all subdomains and associated IP addresses.

Question 11

Which TWO of the following tools are specifically designed for footprinting and reconnaissance tasks? (Select two.)

Accepted Answer

Shodan. Shodan is a search engine specifically designed for footprinting and reconnaissance by scanning and indexing internet-connected devices, such as IoT devices, servers, and industrial control systems. It allows attackers to gather information about open ports, services, and banners without direct interaction with the target, making it a primary tool for passive reconnaissance in the CEH context.

Answer

Nmap

Answer

Metasploit

Answer

John the Ripper

Question 12

What can be inferred from the output?

Accepted Answer

The domain has two mail servers with different priority levels.. The output shows two MX records for the domain, each with a different priority value (e.g., 10 and 20). Lower priority numbers indicate higher preference, so the mail server with priority 10 is tried first, and the one with priority 20 is a backup. This directly indicates the domain has two mail servers with different priority levels, which is exactly what MX records are designed to convey.

Answer

The command failed because the DNS server is unreachable.

Answer

The domain uses SPF records to prevent email spoofing.

Answer

The domain's web server IP address is 192.168.1.1.

Question 13

You are a penetration tester for a security firm. Your client, Acme Corp, has requested an external reconnaissance assessment. They have provided their primary domain 'acme.com'. You begin by performing passive footprinting using public sources. After gathering initial information, you want to identify their email servers, subdomains, and any exposed services. You also want to map their network infrastructure without directly interacting with their systems to avoid detection. Which course of action should you take next?

Accepted Answer

Use Shodan to search for Acme Corp's IP ranges and perform DNS enumeration to discover subdomains and mail servers.. Option B is correct because Shodan allows passive identification of exposed services, including email servers and subdomains, by querying its indexed data of internet-facing devices without sending any packets to Acme Corp's systems. DNS enumeration can then be performed passively using public DNS records (e.g., MX, NS, A records) to map subdomains and mail servers, fulfilling the requirement to avoid direct interaction and detection.

Answer

Call Acme Corp's IT help desk posing as an employee to ask about their email server configuration.

Answer

Perform a traceroute to Acme Corp's web server to map the network path.

Answer

Run an Nmap scan against the entire IP range of Acme Corp to identify open ports and services.

Question 14

During a penetration test, you discover that the target organization uses a cloud-based email service. Which technique would allow you to gather employee email addresses and potentially infer internal organizational structure?

Accepted Answer

Use Google dorking to find publicly exposed email lists. Google dorking (advanced search operators) can uncover publicly exposed documents, such as PDFs or spreadsheets, that contain employee email addresses. These documents are often indexed by search engines and can reveal email patterns (e.g., first.last@company.com) and departmental groupings, allowing inference of the internal organizational structure without interacting directly with the target's infrastructure.

Answer

Perform a WHOIS lookup on the domain

Answer

Attempt a DNS zone transfer

Answer

Run an nmap scan against the mail server

Question 15

Which TWO of the following tools are commonly used for passive reconnaissance?

Accepted Answer

theHarvester. theHarvester is a passive reconnaissance tool that gathers information from public sources such as search engines (Google, Bing), PGP key servers, and the Shodan API without directly interacting with the target network. It collects email addresses, subdomains, IPs, and employee names by querying publicly available data, making it a purely passive technique.

Answer

nmap

Answer

Netcat

Answer

Metasploit