CEH Footprinting, Reconnaissance and Scanning Practice Question
A penetration tester uses the following Google dork: intitle:"index of" "backup" site:example.com. What is the MOST likely goal of this search?
⚠ Common exam trap
Watch out — candidates often confuse the purpose of Google dorks, thinking 'index of' always reveals login pages or subdomains, when in fact it specifically identifies directories with listing enabled, and the 'backup' keyword pinpoints potentially sensitive data exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Locate open directories that might contain sensitive files
The Google dork `intitle:"index of" "backup" site:example.com` targets web servers that have directory listing enabled (indicated by the page title containing 'index of') and that contain a folder or file named 'backup'. This is a classic reconnaissance technique to find open directories where backup files (e.g., database dumps, configuration files) may be inadvertently exposed, potentially containing sensitive data such as credentials or proprietary information.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Locate open directories that might contain sensitive files
Why this is correct
The `intitle:"index of"` Google dork specifically targets web server directory listings that lack proper configuration to prevent browsing. When combined with keywords like `(backup|bak|old|temp)` (implied by the context of sensitive files), it effectively filters for directories likely containing sensitive, unindexed files such as database backups, configuration files, or temporary data. This technique is a highly effective reconnaissance method for uncovering misconfigurations that expose critical information.
- ✗
Discover email addresses associated with the domain
Why it's wrong here
This dork, focused on `intitle:"index of"` and backup-related keywords, is designed to locate directory listings, not specific text patterns within page content. Email addresses are typically found embedded within the body of web pages, contact forms, or documents, requiring `intext:` or `filetype:` operators combined with email patterns (e.g., `@domain.com`). Therefore, it is ineffective for discovering email addresses associated with a domain.
- ✗
Find login pages of the target domain
Why it's wrong here
The specified Google dork is engineered to identify open directory listings and files related to backups, not authentication interfaces. Login pages typically feature distinct title elements such as `intitle:"Login"`, `intitle:"Sign In"`, or `intitle:"Account"`, and are rarely exposed through directory indexing or stored as simple backup files in publicly accessible directories. Consequently, this dork would not yield relevant results for finding login portals.
- ✗
Identify subdomains of example.com
Why it's wrong here
Identifying subdomains requires specific Google dorking techniques that leverage the `site:` operator in conjunction with wildcards, such as `site:*.example.com -site:www.example.com`. The `intitle:"index of"` dork, however, exclusively searches for specific keywords within the HTML title tag of indexed pages. It does not analyze the domain structure or enumerate different hostnames under a parent domain, making it unsuitable for subdomain discovery.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.