CEH Footprinting and Reconnaissance Practice Question
An ethical hacker wants to discover subdomains of a target domain using only public information. Which of the following techniques is MOST effective?
⚠ Common exam trap
EC-Council often tests the misconception that WHOIS records contain subdomain information, but WHOIS only holds domain registration data, not DNS resource records like A or CNAME entries for subdomains.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the site: operator in search engines
The `site:` operator in search engines (e.g., Google) allows an ethical hacker to enumerate publicly indexed subdomains of a target domain by querying `site:*.targetdomain.com`. This technique leverages the search engine's crawl data to discover subdomains that are publicly accessible but may not be linked from the main site, making it the most effective method for passive, public-information-only reconnaissance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run a traceroute to the main domain
Why it's wrong here
Running a traceroute maps the network path (routers, firewalls) between a source and a destination IP address by sending packets with incrementing Time-To-Live (TTL) values. While it reveals network topology and latency, it does not query DNS records for subdomains or list hostnames beyond the immediate hop. Therefore, it is entirely ineffective for enumerating subdomains associated with a target domain.
- ✗
Check the WHOIS record for the domain
Why it's wrong here
WHOIS records provide publicly available information about a domain's registration, including the registrant's contact details, registration and expiration dates, and associated nameservers. While essential for identifying domain ownership and administrative contacts, WHOIS databases do not store or expose information about specific subdomains configured under the main domain, as subdomains are managed within the domain's private DNS zone files.
- ✓
Use the site: operator in search engines
Why this is correct
The `site:` operator in search engines like Google restricts search results to a specific domain, including all its indexed subdomains. By querying `site:target.com`, an ethical hacker can leverage the vast indexing capabilities of search engines to passively discover publicly accessible subdomains that have been crawled and cataloged. This provides a quick and effective method for initial reconnaissance without directly interacting with the target's servers.
- ✗
Perform a reverse DNS lookup on the target IP range
Why it's wrong here
Performing a reverse DNS lookup translates an IP address back into a hostname using Pointer (PTR) records. While useful for identifying the primary hostname associated with a specific IP address, it is not a comprehensive method for subdomain discovery. This is because not all subdomains resolve to unique IP addresses with corresponding PTR records, and many subdomains might share an IP address or simply lack a PTR record altogether, limiting its effectiveness for full enumeration.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.