Security Concepts →mediumMultiple Select

200-201 Security Concepts Practice Question

A security analyst is configuring a firewall to block common reconnaissance techniques. Which THREE types of reconnaissance traffic should be blocked to prevent active reconnaissance? (Choose three.)

⚠ Common exam trap

A common mix-up: candidates confuse passive reconnaissance (e.g., WHOIS, social engineering) with active reconnaissance; candidates may incorrectly select social engineering or WHOIS because they are reconnaissance types, but they do not generate blockable network traffic.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Vulnerability scanning

Vulnerability scanning (C) is active reconnaissance because the attacker directly sends probes to the target to identify weaknesses, generating traffic the firewall can detect and block. Port scanning (D) is active reconnaissance since tools like Nmap send TCP SYN, FIN, or UDP packets to enumerate open ports on the target hosts. Ping sweeps (E) are active reconnaissance because ICMP Echo Request packets are sent across an address range to discover live hosts. WHOIS lookups (B) are passive reconnaissance, as they query public registration databases rather than the target's own systems, so a firewall cannot block them. Social engineering (A) is a human-based attack that involves no network traffic to the firewall and is therefore not a reconnaissance traffic type to filter.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Social engineering
Why it's wrong here
Social engineering targets people through phishing or pretexting, generating no network traffic for a firewall to inspect, so it cannot be blocked by packet rules. It is tempting because it is a recognised reconnaissance category, and would be addressed through security awareness training and email filtering instead.
✗
WHOIS lookups
Why it's wrong here
WHOIS queries hit public registry servers, not the target's hosts, so firewall rules on the perimeter cannot intercept them; they are passive reconnaissance. Blocking them is tempting because WHOIS reveals registrant and DNS ownership data, useful when mapping an external footprint from third-party sources rather than active probing.
✓
Vulnerability scanning
Why this is correct
Vulnerability scanning actively probes target systems with crafted packets to identify known weaknesses, generating detectable traffic that a firewall can block. This satisfies the stem's requirement to prevent active reconnaissance, since scanning directly interacts with the target rather than gathering data passively from public sources.
✓
Port scanning
Why this is correct
Port scanning is active reconnaissance: the attacker sends TCP SYN, FIN or UDP probes directly to target hosts, eliciting responses that reveal open ports and services. Blocking it at the firewall satisfies the stem's requirement to prevent active reconnaissance, since traffic is attacker-initiated rather than passively gathered from public sources.
✓
Ping sweeps
Why this is correct
Ping sweeps use ICMP echo requests to map live hosts across a subnet, generating direct traffic to the target. Blocking them at the firewall prevents attackers from enumerating active systems, satisfying the requirement to stop active reconnaissance, which involves interaction with the target rather than passive data gathering.

Visual reference

Go deeper

200-201 Security Concepts Practice Question

Why each option matters

Option-by-option breakdown

Related to this question