CEH Footprinting, Reconnaissance and Scanning Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Performing a WHOIS lookup on the target's domain

  Why this is correct

  Performing a WHOIS lookup involves querying publicly accessible databases maintained by domain registrars and registries. This action retrieves domain registration details such as registrant contact information, administrative contacts, technical contacts, and registration dates without sending any packets directly to the target's infrastructure. Since the interaction is solely with a third-party public database, it constitutes passive reconnaissance.

• ✓

  Querying a public DNS resolver cache for the target's mail server records

  Why this is correct

  Querying a public DNS resolver cache for specific records, like mail server (MX) records, is a passive reconnaissance technique. This method leverages information already cached by third-party public DNS servers, which have previously resolved queries for the target domain. The analyst does not directly interact with the target's authoritative DNS servers, thus avoiding any direct network traffic that could be detected.

• ✗

  Running an Nmap SYN scan against the target's web server

  Why it's wrong here

  Running an Nmap SYN scan is a definitive form of active reconnaissance because it involves sending TCP SYN packets directly to the target's web server. This action attempts to initiate a three-way handshake and elicits a response, such as a SYN/ACK for open ports or an RST for closed ports. Such direct network interaction generates traffic on the target's network, which can be logged and detected by intrusion detection systems.

• ✗

  Banner grabbing with Netcat on port 80

  Why it's wrong here

  Banner grabbing with Netcat on port 80 is an active reconnaissance technique as it requires establishing a direct TCP connection to the target's web server. Upon connection, the tool sends a request, typically an HTTP GET request, to elicit a response that often includes server software version information, known as a banner. This direct communication with the target's application layer leaves a clear footprint on their systems and network logs.

• ✓

  Using Google dork queries to find exposed documents

  Why this is correct

  Using Google dork queries involves leveraging advanced search engine operators to find publicly indexed information related to the target, such as exposed documents, configuration files, or directory listings. This method relies entirely on data already collected and stored by search engines, meaning the analyst never directly communicates with the target's web servers or infrastructure. It is a highly effective passive technique for discovering inadvertently disclosed information without leaving any trace on the target's network.

Go deeper

Related to this question