CEH Footprinting, Reconnaissance and Scanning Practice Question
A security analyst performs a passive reconnaissance of a target domain using public resources. Which of the following techniques would be considered passive reconnaissance?
⚠ Common exam trap
It's easy for candidates to confuse 'using public resources' (like WHOIS databases) with 'sending network probes' (like banner grabbing or pings), assuming any information-gathering tool is passive if it doesn't exploit vulnerabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Performing a WHOIS lookup for the target domain
Passive reconnaissance involves gathering information without directly interacting with the target's systems, thus avoiding any network traffic that could be detected. A WHOIS lookup queries a public registry database (e.g., whois.arin.net) over port 43 or via a web interface, retrieving domain registration details without sending any packets to the target's own infrastructure. This makes it a purely passive technique.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Using Netcat to grab banners from the target's email server
Why it's wrong here
Using Netcat to grab banners from a target's email server involves establishing a direct TCP connection to a specific port (e.g., 25 for SMTP) on that server. This connection attempt and the subsequent receipt of service banners constitute an active interaction. The target system's network devices and logs will record this connection, making it detectable and therefore not a passive reconnaissance technique.
- ✗
Running Nmap SYN scan on the target's web server
Why it's wrong here
Running an Nmap SYN scan on a target's web server is a definitive form of active reconnaissance. This technique sends SYN packets to target ports, and while it doesn't complete the full TCP three-way handshake, the target system still receives and responds to these probes (with SYN/ACK or RST packets). This direct network interaction generates traffic that can be detected and logged by firewalls, intrusion detection systems, and the target server itself.
- ✓
Performing a WHOIS lookup for the target domain
Why this is correct
Performing a WHOIS lookup for a target domain is a classic example of passive reconnaissance. This process involves querying public databases maintained by domain registrars and registries to retrieve registration information, such as registrant contact details, domain creation/expiration dates, and nameservers. Crucially, these queries are directed at third-party WHOIS servers, not the target domain's actual servers, meaning no direct network traffic is sent to or received from the target, leaving no trace.
- ✗
Sending a ping sweep to the target's public IP range
Why it's wrong here
Sending a ping sweep to a target's public IP range is an active reconnaissance method designed to identify live hosts within a network segment. This technique involves transmitting ICMP Echo Request packets to multiple IP addresses. Any active host that receives an Echo Request is expected to respond with an ICMP Echo Reply, directly revealing its presence. This direct probing generates network traffic that originates from the attacker and is processed by the target network, making it easily detectable.
Go deeper
Related to this question
Learn chapter
Footprinting and Reconnaissance
Key term
WHOIS lookup
WHOIS lookup is a query and response protocol used to search databases that store the registration information of domain names and IP address blocks.
Key term
Passive reconnaissance
Passive reconnaissance is the process of gathering information about a target system or network without directly interacting with it, using publicly available sources and stealthy observation.
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.