CEH Footprinting, Reconnaissance and Scanning Practice Question
A security analyst wants to perform passive reconnaissance on a target domain. Which TWO of the following methods are considered passive? (Choose 2)
⚠ Common exam trap
EC-Council often tests the distinction between passive and active reconnaissance by including tools like Shodan (which is passive) alongside active scanning tools like Nmap, leading candidates to mistakenly classify Shodan as active because it involves a search engine rather than direct network interaction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
WHOIS lookup
WHOIS lookup is passive because it queries public registration databases (e.g., ARIN, RIPE) via the WHOIS protocol (RFC 3912) to retrieve domain ownership, registrar, and name server information without sending any packets to the target's own infrastructure. This data is publicly available and does not interact with the target's servers or network, making it a classic passive reconnaissance technique.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
WHOIS lookup
Why this is correct
A WHOIS lookup involves querying publicly accessible databases maintained by domain registrars and regional internet registries (RIRs) to retrieve information about a domain name or IP address. This process is entirely passive because the queries are directed at third-party databases, not the target's systems, ensuring no direct network traffic is sent to the target organization. Information gathered can include registrant contact details, registration and expiration dates, and nameservers.
- ✓
Shodan search
Why this is correct
A Shodan search is a passive reconnaissance technique because it involves querying Shodan's extensive database of Internet-connected devices and services. Shodan continuously scans the internet independently, collecting banner information and metadata from various ports and protocols. When an analyst uses Shodan, they are simply accessing pre-collected data from a third-party source, thus avoiding any direct interaction or traffic generation towards the target's network.
- ✗
Telnet banner grab
Why it's wrong here
Performing a Telnet banner grab is an active reconnaissance method because it requires establishing a direct TCP connection to a specific port on the target system. By initiating a connection, the analyst sends packets to the target, prompting the service to respond with its identifying banner information. This direct interaction generates network traffic that can be logged or detected by the target's security systems, making it a detectable activity.
- ✗
Ping sweep
Why it's wrong here
A ping sweep is considered an active reconnaissance technique because it involves sending Internet Control Message Protocol (ICMP) echo request packets to a range of IP addresses within a target network. The purpose is to identify live hosts that respond with an ICMP echo reply. This direct transmission of packets to the target's network generates measurable traffic and can be detected by firewalls or intrusion detection systems, making it an overt action.
- ✗
Nmap SYN scan
Why it's wrong here
An Nmap SYN scan, also known as a half-open scan, is a highly active reconnaissance method. It involves sending a TCP SYN packet to a target port and then, upon receiving a SYN/ACK response, immediately sending an RST packet instead of completing the three-way handshake. This direct packet injection into the target's network, even without full connection establishment, is a detectable interaction that generates network traffic and can trigger alerts on intrusion detection systems.
Go deeper
Related to this question
Learn chapter
Footprinting and Reconnaissance
Key term
WHOIS lookup
WHOIS lookup is a query and response protocol used to search databases that store the registration information of domain names and IP address blocks.
Key term
Passive reconnaissance
Passive reconnaissance is the process of gathering information about a target system or network without directly interacting with it, using publicly available sources and stealthy observation.
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.