CEH Footprinting, Reconnaissance and Scanning Practice Question
A security analyst wants to gather information about a target domain without directly interacting with its systems. Which technique would be MOST appropriate?
⚠ Common exam trap
A common mix-up: candidates confuse active scanning (like Nmap or Nessus) with passive reconnaissance, failing to recognize that any packet sent to the target constitutes direct interaction, whereas WHOIS queries are entirely external to the target's infrastructure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Query WHOIS databases for domain registration information
Querying WHOIS databases is a passive reconnaissance technique that retrieves publicly available domain registration information (e.g., registrar, creation/expiration dates, name servers, and administrative contacts) without sending any packets to the target's systems. This aligns with the goal of gathering information without direct interaction, as defined in the CEH footprinting phase.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Send ICMP echo requests to the target network
Why it's wrong here
Sending ICMP echo requests, commonly known as pings, directly transmits packets to the target's network hosts. This active probing elicits a response, such as an ICMP echo reply, which directly interacts with the target's network stack and can be logged or detected by network monitoring systems and firewalls. Therefore, it is a clear form of active reconnaissance.
- ✗
Run a vulnerability scan with Nessus
Why it's wrong here
Running a vulnerability scan with Nessus involves sending numerous specially crafted network probes and authentication attempts to target systems and services. These intrusive checks are designed to identify specific vulnerabilities, directly interacting with the target's operating system and applications. Such extensive and direct interaction is highly detectable and constitutes active reconnaissance.
- ✗
Perform a port scan using Nmap SYN scan
Why it's wrong here
Performing a port scan using Nmap's SYN scan technique, also known as a half-open scan, involves sending TCP SYN packets to target ports without completing the three-way handshake. While stealthier than a full connect scan, it still directly transmits packets to the target's network stack and awaits SYN/ACK or RST responses. This direct packet interaction makes it an active reconnaissance method, detectable by intrusion detection systems.
- ✓
Query WHOIS databases for domain registration information
Why this is correct
Querying WHOIS databases for domain registration information is a passive reconnaissance technique because it retrieves publicly available data from centralized registries and registrars. This process does not send any network traffic directly to the target organization's servers or network infrastructure. Instead, it accesses information that has been voluntarily submitted and made public, such as registrant details, name servers, and registration dates, without alerting the target.
Go deeper
Related to this question
Learn chapter
Footprinting and Reconnaissance
Key term
Passive reconnaissance
Passive reconnaissance is the process of gathering information about a target system or network without directly interacting with it, using publicly available sources and stealthy observation.
Key term
Covering Tracks
Covering tracks is the process attackers use to hide their activity and remove evidence of a security breach after gaining unauthorized access to a system.
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.