CEH Footprinting, Reconnaissance and Scanning Practice Question

A security analyst is planning a reconnaissance activity that must remain undetected. Which TWO of the following techniques should they choose?

⚠ Common exam trap

It's easy for candidates to confuse 'passive reconnaissance' with 'stealth scanning,' assuming that techniques like SYN scan or Nmap's default scripts are undetected, when in fact any direct packet transmission to the target is active and detectable.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Gather information from public OSINT sources like Shodan and social media

OSINT sources like Shodan and social media provide publicly available information without interacting with the target's systems, keeping the reconnaissance passive and undetected. Option C is correct because passive reconnaissance via DNS records (e.g., using cached or third-party DNS databases) avoids querying the target's authoritative DNS servers, thus not generating logs or alerts on the target's infrastructure.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Engage in social engineering to extract network diagrams from employees
Why it's wrong here
Social engineering, by its nature, involves direct human interaction and manipulation to obtain information. This is an active form of reconnaissance that carries a significant risk of detection, as employees might report suspicious inquiries or behavior. Such direct engagement contradicts the goal of performing reconnaissance without alerting the target.
✓
Gather information from public OSINT sources like Shodan and social media
Why this is correct
Collecting data from Open Source Intelligence (OSINT) sources, such as Shodan for internet-facing device information or social media for organizational details, is a purely passive reconnaissance technique. This method involves querying publicly available databases and websites, generating no direct network traffic to the target's infrastructure, thus ensuring complete undetectability.
✓
Conduct a passive reconnaissance by analyzing DNS records without querying the target's DNS servers directly
Why this is correct
Analyzing DNS records passively involves querying third-party DNS databases, public DNS resolvers, or cached records from services like DNSDumpster, rather than directly contacting the target's authoritative DNS servers. This approach avoids generating any network traffic or log entries on the target's systems, making it an undetectable method for mapping their network infrastructure.
✗
Use Nmap with default scripts to enumerate services
Why it's wrong here
Using Nmap, even with its default scripts for service enumeration, constitutes active reconnaissance. This tool sends specially crafted packets directly to the target's hosts and ports to identify open services and their versions. This direct interaction generates network traffic that can be logged, detected by Intrusion Detection Systems (IDS), or blocked by firewalls, thereby alerting the target.
✗
Perform a full TCP connect scan on all ports
Why it's wrong here
A full TCP connect scan is an overtly active and noisy reconnaissance technique. It attempts to complete the full three-way TCP handshake (SYN, SYN-ACK, ACK) for every port it probes. This process generates a substantial volume of network traffic and numerous connection attempts that are easily logged by firewalls and detected by network monitoring tools or Intrusion Prevention Systems (IPS), making it highly detectable.

Visual reference

Go deeper

CEH Footprinting, Reconnaissance and Scanning Practice Question

Why each option matters

Option-by-option breakdown

Related to this question