200-201 Security Concepts Practice Question
A security analyst is investigating a potential data breach. Which two actions are examples of passive reconnaissance? (Choose two.)
⚠ Common exam trap
Test-takers frequently confuse any information-gathering activity as passive; candidates often mistakenly classify ping sweeps or port scans as passive because they seem less intrusive than exploitation, but they are active and detectable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Searching for employee information on LinkedIn
Option B is correct because searching LinkedIn for employee information is passive reconnaissance: the analyst gathers publicly available OSINT about personnel, roles, and organizational structure without sending any packets to or interacting with the target's systems, so it cannot be detected by the target. Option D is correct because a WHOIS lookup queries public registry databases (via port 43 to the registrar/RIR) for domain registration details such as registrant, admin contacts, name servers, and creation/expiry dates; this information is obtained from third-party records rather than from the target's own infrastructure, making it passive. The unmarked options do not belong: A (port scan) and C (ping sweep) are active reconnaissance techniques that directly probe the target's hosts and services and are detectable in logs or IDS/IPS, while E (phishing email) is an active social-engineering attack that interacts with employees and is not reconnaissance at all.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Performing a port scan on the company's web server
Why it's wrong here
Port scanning sends crafted packets to the target's web server, which is active reconnaissance and detectable. It is tempting because scanning is quiet and unauthenticated, but touching the target directly is active; passive reconnaissance uses only publicly available information without contacting the target.
- ✓
Searching for employee information on LinkedIn
Why this is correct
Searching LinkedIn for employee information gathers publicly available data without directly touching the target's systems, so no traffic reaches company infrastructure. This indirect, non-intrusive collection is passive reconnaissance, unlike active scanning or enumeration, which would interact with and potentially alert the target.
- ✗
Using a ping sweep to identify live hosts
Why it's wrong here
A ping sweep transmits packets to target hosts and elicits responses, making it active reconnaissance. It is tempting because it is low-noise and unauthenticated, but any direct probe of the target's network is active; passive methods instead query third-party or public sources.
- ✓
Conducting a WHOIS lookup on the company domain
Why this is correct
A WHOIS lookup queries public domain registration records, revealing registrant, administrative and technical contact details without sending any traffic to the target's own infrastructure. Because it relies on third-party public data rather than direct interaction, it qualifies as passive reconnaissance.
- ✗
Sending a phishing email to employees
Why it's wrong here
Phishing emails actively interact with targets, soliciting credentials or clicks, which is active reconnaissance and also intrusive. It is tempting because social engineering gathers information, but passive reconnaissance relies on publicly available data without directly engaging the target's systems or users.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.