Footprinting and Reconnaissance

An ethical hacker wants to discover subdomains of a target domain using only public information. Which of the following techniques is MOST effective?

Which TWO of the following are examples of passive footprinting techniques? (Select exactly 2.)

During the reconnaissance phase, a tester discovers that the target company's email server is configured to automatically respond to delivery status notifications (DSNs). Which type of attack could this information facilitate?

Which TWO of the following tools are specifically designed for footprinting and reconnaissance tasks? (Select two.)

Which THREE of the following are valid pieces of information that can be gathered from a properly configured Netcraft site report? (Select exactly 3.)

What can be inferred from the output?

Drag and drop the steps to set up a VPN using IPsec in tunnel mode into the correct order.

An ethical hacker is building a profile of a target organization's employees and wants to identify names, job titles, and email address formats using only information the organization has published. Which technique is BEST suited to this goal?

You are a penetration tester for a security firm. Your client, Acme Corp, has requested an external reconnaissance assessment. They have provided their primary domain 'acme.com'. You begin by performing passive footprinting using public sources. After gathering initial information, you want to identify their email servers, subdomains, and any exposed services. You also want to map their network infrastructure without directly interacting with their systems to avoid detection. Which course of action should you take next?

An ethical hacker runs the command shown in the exhibit. Which of the following conclusions can be drawn from the output?

During a penetration test, you discover that the target organization uses a cloud-based email service. Which technique would allow you to gather employee email addresses and potentially infer internal organizational structure?

Match each CEH phase to its key activity.

A security analyst is tasked with performing passive reconnaissance on a target organization. Which of the following is the BEST approach to gather information about the target's technology stack without directly interacting with the target's systems?

During an authorized external assessment, a tester wants to determine which mail exchangers and third-party SaaS providers a target uses without alerting the target's security team. The tester already knows the primary domain. Which single command best reveals the target's MX records using a public resolver while sending no traffic to the target itself?

Refer to the exhibit. An attacker runs the nslookup command shown. What information has been gathered?