CCNA Footprinting and Reconnaissance Questions

MCQeasy

An ethical hacker wants to discover subdomains of a target domain using only public information. Which of the following techniques is MOST effective?

A.Run a traceroute to the main domain

B.Check the WHOIS record for the domain

C.Use the site: operator in search engines

D.Perform a reverse DNS lookup on the target IP range

AnswerC

The `site:` operator in search engines like Google restricts search results to a specific domain, including all its indexed subdomains. By querying `site:target.com`, an ethical hacker can leverage the vast indexing capabilities of search engines to passively discover publicly accessible subdomains that have been crawled and cataloged. This provides a quick and effective method for initial reconnaissance without directly interacting with the target's servers.

Why this answer

The `site:` operator in search engines (e.g., Google) allows an ethical hacker to enumerate publicly indexed subdomains of a target domain by querying `site:*.targetdomain.com`. This technique leverages the search engine's crawl data to discover subdomains that are publicly accessible but may not be linked from the main site, making it the most effective method for passive, public-information-only reconnaissance.

Exam trap

EC-Council often tests the misconception that WHOIS records contain subdomain information, but WHOIS only holds domain registration data, not DNS resource records like A or CNAME entries for subdomains.

How to eliminate wrong answers

Option A is wrong because traceroute (using ICMP or UDP probes) reveals the network path and intermediate routers, not subdomains; it operates at Layer 3 and does not query DNS records or web indexes. Option B is wrong because WHOIS records contain registration details (registrant, name servers, dates) but do not list subdomains; they are used for domain ownership and administrative information, not DNS enumeration. Option D is wrong because reverse DNS lookup (PTR records) maps IP addresses to hostnames, but it requires knowing the target IP range and only reveals hostnames that have PTR records configured, which is not a reliable method for discovering all subdomains from public information alone.

Practice this question →

Multi-Selectmedium

Which TWO of the following are examples of passive footprinting techniques? (Select exactly 2.)

Select 2 answers

A.Performing a ping sweep on the target network

B.Conducting a port scan with Nmap

C.Using Google dorking to find exposed documents

D.Examining job postings for technology clues

E.Brute forcing subdomains via DNS queries

AnswersC, D

Using Google dorking involves leveraging advanced search operators to query Google's pre-existing index for publicly available information about a target, such as exposed documents or misconfigured servers. The interaction occurs solely with Google's search engine, not directly with the target's systems. This method is passive because it relies on information already indexed by a third party, leaving no direct trace on the target's network.

Why this answer

Google dorking involves using advanced search operators (e.g., filetype:, intitle:) to discover publicly accessible information without directly interacting with the target's systems. This is a passive footprinting technique as it relies on publicly indexed data from search engines, not on sending packets to the target's network.

Exam trap

EC-Council often tests the distinction between passive and active reconnaissance, and the trap here is that candidates may mistakenly classify DNS-based enumeration (Option E) as passive, when in fact any technique that sends packets to the target's systems (including DNS queries) is considered active.

Practice this question →

MCQmedium

During the reconnaissance phase, a tester discovers that the target company's email server is configured to automatically respond to delivery status notifications (DSNs). Which type of attack could this information facilitate?

A.DNS cache poisoning

B.Email enumeration

C.Man-in-the-middle attack

D.Phishing attack

AnswerB

Email enumeration is a reconnaissance technique used to discover valid email addresses within an organization. When an email is sent to a non-existent address, the mail server often returns a Delivery Status Notification (DSN) or Non-Delivery Report (NDR) indicating the address was invalid. Conversely, the *absence* of such a bounce, or a specific DSN indicating a deferred delivery rather than an immediate rejection, can confirm the validity of an email address, making DSN responses a valuable tool for identifying active accounts.

Why this answer

Email servers that automatically respond to Delivery Status Notifications (DSNs) as defined in RFC 1891/3464 can be exploited for email enumeration. By sending a message to a non-existent address, the DSN response will indicate the address is invalid, while a valid address may generate no DSN or a different response. This allows an attacker to systematically verify valid email addresses on the target domain without triggering a full bounce-back to the original sender.

Exam trap

EC-Council often tests the distinction between passive reconnaissance (like email enumeration via DSN) and active attacks (like MITM or phishing), so candidates mistakenly choose 'Phishing attack' because they associate email servers with phishing, but the question specifically asks what the DSN behavior facilitates during reconnaissance.

How to eliminate wrong answers

Option A is wrong because DNS cache poisoning targets the DNS resolver's cache with forged records, not email server DSN behavior. Option C is wrong because a man-in-the-middle attack requires intercepting and relaying communications between two parties, which is unrelated to DSN responses. Option D is wrong because phishing is a social engineering attack that uses deceptive messages to steal credentials, not a reconnaissance technique to enumerate valid email addresses.

Practice this question →

Multi-Selecthard

Which TWO of the following tools are specifically designed for footprinting and reconnaissance tasks? (Select two.)

Select 2 answers

A.Shodan

B.Nmap

C.Maltego

D.Metasploit

E.John the Ripper

AnswersA, C

Shodan is a specialized search engine that passively collects and indexes banner information from internet-connected devices, services, and industrial control systems worldwide. It allows ethical hackers to perform reconnaissance by searching for specific device types, open ports, software versions, and potential vulnerabilities without directly interacting with the target. This passive data collection makes it an excellent tool for initial footprinting, providing valuable insights into a target's external attack surface.

Why this answer

Shodan is a search engine specifically designed for footprinting and reconnaissance by scanning and indexing internet-connected devices, such as IoT devices, servers, and industrial control systems. It allows attackers to gather information about open ports, services, and banners without direct interaction with the target, making it a primary tool for passive reconnaissance in the CEH context.

Exam trap

EC-Council often tests the distinction between active and passive reconnaissance tools, and the trap here is that candidates confuse Nmap (active scanning) with footprinting tools, or think Metasploit's auxiliary modules qualify as reconnaissance, when the exam specifically classifies Shodan and Maltego as dedicated footprinting tools.

Practice this question →

MCQhard

You are a penetration tester hired to perform a security assessment for a medium-sized e-commerce company, "ShopSmart". The company hosts its website on a shared hosting environment and uses a third-party payment gateway. Your goal is to gather as much information as possible without triggering any alarms. During the initial footprinting, you discover that the company's domain "shopsmart.com" was registered five years ago and the WHOIS record shows the registrant's name, address, phone number, and email. The email address is "admin@shopsmart.com". You also find a job posting on LinkedIn that mentions they are looking for a "Senior PHP Developer with experience in Laravel and MySQL". Additionally, by using the Wayback Machine, you find an old version of the site that includes a comment in the HTML source: "". You attempt to access /dev/test.php but receive a 404 error. What should you do NEXT to maximize information gain while remaining passive?

A.Use Google dorking with site:shopsmart.com and filetype:php to find cached or indexed pages

B.Run a whois lookup on the IP address of the shared host

C.Try common file extensions for the debug page: test.asp, test.aspx, test.jsp

D.Perform a DNS brute force to find subdomains

AnswerA

Passive search via search engine.

Why this answer

Google dorking with `site:shopsmart.com filetype:php` is a passive reconnaissance technique that leverages cached or indexed pages in Google’s search engine. This can reveal the old `/dev/test.php` page or other PHP files that may still be accessible via cached content, even if the live server returns a 404. It maximizes information gain without sending any direct traffic to the target, thus avoiding alarms.

Exam trap

EC-Council often tests the distinction between passive and active reconnaissance; the trap here is that candidates may choose an active option like DNS brute force or file extension guessing because it seems more direct, but the question explicitly requires remaining passive to avoid triggering alarms.

How to eliminate wrong answers

Option B is wrong because running a whois lookup on the IP address of the shared host will only reveal the hosting provider’s information, not the target company’s specific details, and it does not help locate the debug page or other hidden resources. Option C is wrong because trying common file extensions (test.asp, test.aspx, test.jsp) is an active probing technique that sends requests to the server, potentially triggering alarms, and it assumes the debug page uses a different technology stack than the PHP/Laravel environment indicated by the job posting. Option D is wrong because performing a DNS brute force to find subdomains is an active reconnaissance method that generates DNS queries, which can be logged by the target’s DNS server or security monitoring tools, and it does not directly help recover the specific `/dev/test.php` page.

Practice this question →

Multi-Selecthard

Which THREE of the following are valid pieces of information that can be gathered from a properly configured Netcraft site report? (Select exactly 3.)

Select 3 answers

A.Internal IP addresses of the servers

B.Hosting provider and country

C.Site's first seen date and uptime history

D.Web server software and version

E.Employee email addresses

AnswersB, C, D

Netcraft is highly effective at identifying a website's hosting provider and geographical location. It achieves this by performing comprehensive DNS queries, correlating IP address ranges with registered Autonomous System Numbers (ASNs), and cross-referencing this data with known internet service providers and their physical infrastructure locations. This capability provides critical intelligence regarding the operational footprint and jurisdictional context of a target.

Why this answer

Netcraft site reports are derived from external, public-facing data sources, including DNS records, HTTP response headers, and historical crawl data. The hosting provider and country are identified by mapping the site's public IP address to WHOIS and BGP routing information, which is a standard part of Netcraft's passive reconnaissance.

Exam trap

EC-Council often tests the distinction between passive reconnaissance (which yields only public information) and active reconnaissance (which might reveal internal details), leading candidates to mistakenly assume that internal IPs or employee emails are obtainable from a public site report.

Practice this question →

MCQeasy

What can be inferred from the output?

A.The domain has two mail servers with different priority levels.

B.The command failed because the DNS server is unreachable.

C.The domain uses SPF records to prevent email spoofing.

D.The domain's web server IP address is 192.168.1.1.

AnswerA

The output from a DNS query for MX records explicitly shows multiple entries, each specifying a mail exchanger (mail server) and an associated preference value. These preference values, such as 10 and 20, dictate the order in which sending mail servers should attempt delivery, with lower numbers indicating higher priority. This configuration confirms the existence of two distinct mail servers and establishes a prioritized delivery mechanism, providing both redundancy and a defined failover sequence for incoming email.

Why this answer

The output shows two MX records for the domain, each with a different priority value (e.g., 10 and 20). Lower priority numbers indicate higher preference, so the mail server with priority 10 is tried first, and the one with priority 20 is a backup. This directly indicates the domain has two mail servers with different priority levels, which is exactly what MX records are designed to convey.

Exam trap

The trap here is that candidates may confuse MX records with other DNS record types (like A or TXT) and incorrectly infer unrelated information such as SPF usage or web server IPs, or assume the command failed when it clearly succeeded.

How to eliminate wrong answers

Option B is wrong because the command successfully returned MX records, proving the DNS server is reachable and the query did not fail. Option C is wrong because SPF records are stored as TXT records, not MX records, and the output only shows MX records, so no inference about SPF can be made. Option D is wrong because MX records contain mail server hostnames and their IP addresses are resolved separately via A or AAAA records; the output does not show any web server IP address, and 192.168.1.1 is a private IP that would not appear in public DNS for a domain's web server.

Practice this question →

Drag & Dropmedium

Drag and drop the steps to set up a VPN using IPsec in tunnel mode into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct sequence for setting up a VPN using IPsec in tunnel mode is: Phase 1 (IKE) to establish a secure channel, Phase 2 (IPsec) to negotiate security associations, then define traffic selectors (interesting traffic), apply the policies, and finally test the connection. This order ensures that the underlying secure infrastructure is built before defining and enforcing traffic rules, and that testing validates the entire setup.

Practice this question →

MCQmedium

You are a penetration tester for a security firm. Your client, Acme Corp, has requested an external reconnaissance assessment. They have provided their primary domain 'acme.com'. You begin by performing passive footprinting using public sources. After gathering initial information, you want to identify their email servers, subdomains, and any exposed services. You also want to map their network infrastructure without directly interacting with their systems to avoid detection. Which course of action should you take next?

A.Call Acme Corp's IT help desk posing as an employee to ask about their email server configuration.

B.Use Shodan to search for Acme Corp's IP ranges and perform DNS enumeration to discover subdomains and mail servers.

C.Perform a traceroute to Acme Corp's web server to map the network path.

D.Run an Nmap scan against the entire IP range of Acme Corp to identify open ports and services.

AnswerB

Using Shodan to search for IP ranges and performing DNS enumeration are both passive reconnaissance techniques. Shodan queries publicly indexed internet-connected devices, providing information without direct interaction with the target. Similarly, DNS enumeration, when querying public DNS records (e.g., A, MX, NS records), retrieves publicly available information without sending traffic directly to the target's internal network, making it a stealthy and permissible initial step.

Why this answer

Shodan allows passive identification of exposed services, including email servers and subdomains, by querying its indexed data of internet-facing devices without sending any packets to Acme Corp's systems. DNS enumeration can then be performed passively using public DNS records (e.g., MX, NS, A records) to map subdomains and mail servers, fulfilling the requirement to avoid direct interaction and detection.

Exam trap

EC-Council often tests the distinction between passive and active reconnaissance, and the trap here is that candidates may confuse Shodan (passive) with Nmap (active), or think traceroute is passive because it's a common network diagnostic tool.

How to eliminate wrong answers

Option A is wrong because calling the help desk is active social engineering, not passive reconnaissance, and directly interacts with the client's personnel, which violates the requirement to avoid detection. Option C is wrong because traceroute sends ICMP or UDP packets that directly interact with Acme Corp's routers and firewalls, which is active probing and can be logged or trigger alerts. Option D is wrong because running an Nmap scan sends crafted packets to target systems, which is active scanning that directly interacts with Acme Corp's network and can be detected by intrusion detection systems.

Practice this question →

MCQmedium

An ethical hacker runs the command shown in the exhibit. Which of the following conclusions can be drawn from the output?

A.The domain has two mail exchange servers

B.The DNS server is configured to block zone transfers

C.Mail is automatically forwarded to a backup server

D.The domain has an SPF record configured

AnswerA

When a DNS lookup tool, such as `nslookup`, is used to query for Mail Exchange (MX) records, the response lists the servers designated to receive email for that domain. The presence of two distinct MX records in the output explicitly indicates that the domain has two separate mail exchange servers configured. Each record points to a specific host responsible for handling incoming mail, often with a preference value to guide delivery order.

Why this answer

The output shows two MX records for the domain, each with a preference value (10 and 20). MX records specify mail exchange servers, and the presence of two distinct entries indicates the domain has two mail exchange servers. The lower preference value (10) is the primary server, and the higher value (20) is a secondary or backup server.

Exam trap

The trap here is that candidates may assume multiple MX records imply automatic forwarding or failover, but in reality, the secondary server only receives mail if the primary is unreachable, and forwarding is a separate server-side configuration.

How to eliminate wrong answers

Option B is wrong because the output does not show any attempt to perform a zone transfer (e.g., using `dig axfr` or `nslookup -type=axfr`), nor does it include an error message or response indicating a zone transfer block; it only displays MX records. Option C is wrong because mail forwarding to a backup server is not automatically determined by the presence of multiple MX records; the backup server is explicitly configured with a higher preference value, and forwarding behavior depends on the mail server configuration, not the DNS records alone. Option D is wrong because the output shows only MX records, not TXT records; SPF records are stored in TXT records (or SPF RR type, though deprecated), and no TXT record is displayed in the output.

Practice this question →

MCQhard

During a penetration test, you discover that the target organization uses a cloud-based email service. Which technique would allow you to gather employee email addresses and potentially infer internal organizational structure?

A.Perform a WHOIS lookup on the domain

B.Attempt a DNS zone transfer

C.Run an nmap scan against the mail server

D.Use Google dorking to find publicly exposed email lists

AnswerD

Google dorking involves using advanced search operators to find specific information that is publicly indexed but not easily discoverable through regular searches. By crafting precise queries, such as `site:target.com filetype:xls "email"` or `inurl:contact intitle:"staff directory" @target.com`, an attacker can uncover publicly exposed documents, spreadsheets, or web pages containing lists of employee email addresses that the organization inadvertently left accessible. This is a highly effective OSINT technique for email harvesting.

Why this answer

Google dorking (advanced search operators) can uncover publicly exposed documents, such as PDFs or spreadsheets, that contain employee email addresses. These documents are often indexed by search engines and can reveal email patterns (e.g., first.last@company.com) and departmental groupings, allowing inference of the internal organizational structure without interacting directly with the target's infrastructure.

Exam trap

The trap here is that candidates often confuse active reconnaissance techniques (like DNS zone transfer or nmap scanning) with passive information gathering, assuming they are the primary way to collect email addresses, when in fact publicly indexed documents via Google dorking are a simpler and more effective passive method.

How to eliminate wrong answers

Option A is wrong because WHOIS lookup returns domain registration details (registrant, admin contact, name servers) but not employee email addresses or organizational structure. Option B is wrong because DNS zone transfer (AXFR request) is typically disabled on modern DNS servers; even if successful, it reveals hostnames and IP addresses, not employee email addresses. Option C is wrong because an nmap scan against the mail server identifies open ports and services (e.g., SMTP, IMAP) but does not extract email addresses or organizational hierarchy.

Practice this question →

Matchingmedium

Match each CEH phase to its key activity.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Gathering information about the target

Identifying live hosts, open ports, and services

Exploiting vulnerabilities to enter the system

Installing backdoors for persistent access

Clearing logs and hiding evidence

Why these pairings

The five phases of ethical hacking (as per EC-Council) are Reconnaissance, Scanning & Enumeration, Gaining Access, Maintaining Access, and Clearing Tracks. In this set, options A-D correctly match phases to their key activities, while options E and F are distractors with swapped definitions.

Practice this question →

MCQhard

A security analyst is tasked with performing passive reconnaissance on a target organization. Which of the following is the BEST approach to gather information about the target's technology stack without directly interacting with the target's systems?

A.Engage in social engineering via phone calls

B.Use Shodan to search for target infrastructure

C.Initiate a DNS zone transfer request

D.Perform a port scan with Nmap

AnswerB

Utilizing Shodan for target infrastructure searches is a quintessential passive reconnaissance technique because it relies entirely on pre-collected, publicly available data. Shodan continuously scans the internet and indexes information about internet-connected devices, services, and their configurations, storing this data in its own databases. An analyst querying Shodan does not send any direct network traffic to the target's systems, thereby avoiding detection and remaining completely non-intrusive.

Why this answer

Shodan is a search engine that indexes banners from internet-connected devices, allowing an analyst to discover a target's exposed services, open ports, and technology stack (e.g., web servers, SSH versions, IoT devices) without sending any packets to the target's systems. This makes it a purely passive reconnaissance technique, as it relies on Shodan's pre-collected data rather than direct interaction.

Exam trap

EC-Council often tests the distinction between passive and active reconnaissance, and the trap here is that candidates confuse Shodan (a passive, third-party data source) with active tools like Nmap or DNS zone transfers, which require direct interaction with the target's systems.

How to eliminate wrong answers

Option A is wrong because social engineering via phone calls involves direct interaction with the target's employees, which is an active technique and risks alerting the target. Option C is wrong because initiating a DNS zone transfer request sends a query to the target's DNS server, which is an active interaction that can be logged and often fails due to RFC 1035 restrictions (zone transfers are typically disabled). Option D is wrong because performing a port scan with Nmap sends packets directly to the target's IP addresses, making it an active reconnaissance method that can be detected by intrusion detection systems.

Practice this question →

MCQeasy

Refer to the exhibit. An attacker runs the nslookup command shown. What information has been gathered?

A.Mail server addresses and priority

B.Name server records

C.IP addresses of the web server

D.SPF records for email authentication

AnswerA

When an attacker runs `nslookup` without specifying a query type, the command often defaults to querying A records but will frequently display Mail Exchanger (MX) records if they are configured for the domain, as these are critical for email routing. MX records explicitly list the mail servers responsible for accepting email on behalf of a domain and assign a numerical preference value, indicating the priority for delivery. This allows email clients to attempt delivery to the lowest-preference server first, ensuring redundancy and load balancing.

Why this answer

The nslookup command with the -type=MX query returns mail exchange (MX) records for the domain. The output shows mail server hostnames and their associated priority values (e.g., 10, 20), which indicate the order in which mail servers should be used. This directly reveals the mail server addresses and their priority, making option A correct.

Exam trap

The trap here is that candidates confuse DNS record types—specifically, they may think MX records return IP addresses or SPF data, when in fact MX only returns mail server hostnames and priorities.

How to eliminate wrong answers

Option B is wrong because name server (NS) records are retrieved using -type=NS, not -type=MX; the output shows no NS records. Option C is wrong because IP addresses of the web server are obtained via A or AAAA records, not MX records; MX records only provide mail server hostnames, not web server IPs. Option D is wrong because SPF records are stored as TXT records, not MX records; the -type=MX query does not return SPF data.

Practice this question →