CEH Footprinting and Reconnaissance Practice Question

A security analyst is tasked with performing passive reconnaissance on a target organization. Which of the following is the BEST approach to gather information about the target's technology stack without directly interacting with the target's systems?

⚠ Common exam trap

EC-Council often tests the distinction between passive and active reconnaissance, and the trap here is that candidates confuse Shodan (a passive, third-party data source) with active tools like Nmap or DNS zone transfers, which require direct interaction with the target's systems.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use Shodan to search for target infrastructure

Shodan is a search engine that indexes banners from internet-connected devices, allowing an analyst to discover a target's exposed services, open ports, and technology stack (e.g., web servers, SSH versions, IoT devices) without sending any packets to the target's systems. This makes it a purely passive reconnaissance technique, as it relies on Shodan's pre-collected data rather than direct interaction.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Engage in social engineering via phone calls
Why it's wrong here
Social engineering, particularly through direct phone calls, constitutes an active form of reconnaissance because it involves direct interaction with individuals associated with the target. This method requires the analyst to actively engage in conversation, manipulate, or elicit information, which generates a direct human interaction event. Such direct engagement is easily detectable by the target and carries significant risks of exposure, making it fundamentally non-passive.
✓
Use Shodan to search for target infrastructure
Why this is correct
Utilizing Shodan for target infrastructure searches is a quintessential passive reconnaissance technique because it relies entirely on pre-collected, publicly available data. Shodan continuously scans the internet and indexes information about internet-connected devices, services, and their configurations, storing this data in its own databases. An analyst querying Shodan does not send any direct network traffic to the target's systems, thereby avoiding detection and remaining completely non-intrusive.
✗
Initiate a DNS zone transfer request
Why it's wrong here
Initiating a DNS zone transfer request, specifically an AXFR query, is an active reconnaissance method as it involves directly querying a target's authoritative DNS server for a full copy of its zone file. This direct interaction generates network traffic and is logged by the DNS server, making it easily detectable by network defenders. Furthermore, most properly configured DNS servers restrict zone transfers to authorized secondary servers, meaning such a request would likely be blocked and alert the target.
✗
Perform a port scan with Nmap
Why it's wrong here
Performing a port scan with Nmap is an inherently active reconnaissance technique because it involves sending specially crafted packets directly to the target system's IP address to probe for open ports and services. This direct interaction generates significant network traffic that traverses the target's network perimeter, triggering firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS). Consequently, port scanning is highly detectable and can alert the target to an ongoing reconnaissance effort, making it unsuitable for passive information gathering.

Go deeper

CEH Footprinting and Reconnaissance Practice Question

Why each option matters

Option-by-option breakdown

Related to this question