CEH Footprinting, Reconnaissance and Scanning Practice Question
A security analyst wants to perform passive reconnaissance on a target organization without generating any traffic to the target's network. Which of the following techniques would be MOST appropriate?
⚠ Common exam trap
A common mix-up: candidates confuse active scanning tools (Nmap, hping3, Netcat) with passive information gathering, failing to recognize that any direct packet transmission to the target constitutes active reconnaissance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Performing a WHOIS lookup
WHOIS lookup is a passive reconnaissance technique that queries public databases (e.g., whois.arin.net) for domain registration details without sending any packets to the target's network. It relies on external, publicly available data, thus generating zero traffic to the target organization's infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Running Nmap SYN scan
Why it's wrong here
A Nmap SYN scan, also known as a half-open scan, actively sends TCP SYN packets to target ports. This process attempts to initiate a TCP three-way handshake without completing it, eliciting a SYN/ACK response from open ports. By directly interacting with the target's network stack and generating distinct network traffic, it is inherently an active reconnaissance technique, easily detectable by intrusion detection systems and firewalls.
- ✗
Executing hping3 to probe ports
Why it's wrong here
Executing hping3 to probe ports involves crafting and sending custom TCP, UDP, or ICMP packets directly to the target system. This versatile tool allows for precise control over packet headers, flags, and data, enabling advanced port scanning, firewall testing, and network analysis. Since it directly transmits packets to the target and expects responses, it constitutes an active reconnaissance method, leaving a clear digital footprint.
- ✗
Using Netcat to connect to a service
Why it's wrong here
Using Netcat to connect to a service on a target system involves actively establishing a full TCP three-way handshake with a specific port. This direct connection allows for banner grabbing, sending arbitrary data, or even creating backdoors, but it undeniably generates network traffic that originates from the attacker's machine and terminates at the target. Such direct interaction is a hallmark of active reconnaissance, making it easily detectable by network monitoring tools.
- ✓
Performing a WHOIS lookup
Why this is correct
Performing a WHOIS lookup involves querying publicly available domain registration databases, such as those maintained by ICANN-accredited registrars. This process retrieves information like domain ownership, administrative contacts, technical contacts, and registration dates without sending any packets directly to the target's servers or network infrastructure. Since the interaction is solely with third-party public records, it is a quintessential passive reconnaissance technique, leaving no trace on the target system itself.
Go deeper
Related to this question
Learn chapter
Footprinting and Reconnaissance
Key term
WHOIS lookup
WHOIS lookup is a query and response protocol used to search databases that store the registration information of domain names and IP address blocks.
Key term
Passive reconnaissance
Passive reconnaissance is the process of gathering information about a target system or network without directly interacting with it, using publicly available sources and stealthy observation.
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.