CEH Footprinting, Reconnaissance and Scanning Practice Question
A security analyst wants to gather information about a target domain without sending any packets to the target. Which technique should the analyst use?
⚠ Common exam trap
Candidates often confuse passive reconnaissance (no packets to the target) with active scanning techniques like ping sweeps or port scans, assuming any information gathering requires direct interaction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
WHOIS lookup
WHOIS lookup is a passive reconnaissance technique that queries public databases (e.g., RDAP or WHOIS servers) for domain registration details such as registrar, creation date, and administrative contacts. It requires no packets to be sent to the target domain's infrastructure, making it ideal for information gathering without direct interaction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ping sweep
Why it's wrong here
A ping sweep involves sending Internet Control Message Protocol (ICMP) echo request packets directly to a range of IP addresses on the target network. This direct interaction with the target's hosts generates network traffic that can be logged by firewalls or intrusion detection systems (IDS), making it a clear form of active reconnaissance. The target's systems actively respond, revealing their presence and potentially alerting defenders.
- ✓
WHOIS lookup
Why this is correct
A WHOIS lookup queries publicly accessible databases maintained by domain registrars and regional internet registries (RIRs) to retrieve information like domain ownership, registration dates, and associated contact details. This process does not send any packets or requests directly to the target's network infrastructure or systems. Consequently, it leaves no trace on the target's logs, classifying it as a purely passive reconnaissance technique.
- ✗
Netcat banner grab
Why it's wrong here
Performing a Netcat banner grab requires establishing a full TCP connection to a specific port on the target system, such as port 80 for HTTP or port 22 for SSH. By initiating this connection and sending a request (e.g., an HTTP GET), the target server responds with its service banner, which is logged by the target. This direct, two-way communication makes it an undeniable active reconnaissance method.
- ✗
Nmap SYN scan
Why it's wrong here
An Nmap SYN scan, also known as a half-open scan, sends TCP SYN packets to target ports but does not complete the three-way handshake if a SYN/ACK is received. Although it's stealthier than a full connect scan, these SYN packets still directly interact with the target's network stack, eliciting a response or a reset. This direct network interaction generates traffic that can be detected and logged by network monitoring tools, firmly categorizing it as active reconnaissance.
Go deeper
Related to this question
Learn chapter
Footprinting and Reconnaissance
Key term
Passive reconnaissance
Passive reconnaissance is the process of gathering information about a target system or network without directly interacting with it, using publicly available sources and stealthy observation.
Key term
WHOIS lookup
WHOIS lookup is a query and response protocol used to search databases that store the registration information of domain names and IP address blocks.
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.