Passive Reconnaissance in Ethical Hacking
A security analyst wants to gather information about a target domain using publicly available sources without directly interacting with the target’s systems. Which type of reconnaissance is being performed?
Quick Answer
The answer is passive reconnaissance. This is the correct choice because passive reconnaissance involves gathering information about a target using only publicly available sources—such as WHOIS records, DNS lookups, search engines, and social media—without sending any packets or making direct contact with the target’s systems, thereby leaving no footprint on the target’s network. On the Certified Ethical Hacker CEH exam, this concept tests your understanding of the reconnaissance phase and the critical distinction between passive and active methods; a common trap is confusing passive reconnaissance with active scanning, which involves direct interaction like port scans or ping sweeps. To remember, think of the word “passive” as “passive observer”—you are only watching and collecting data that is already out in the open, never touching the target. A useful mnemonic is “PASSIVE = Publicly Available Sources, Silent, Stealthy, Invisible, Very Ethical.”
⚠ Common exam trap
A common mix-up: candidates confuse passive reconnaissance with active reconnaissance; candidates often think any information gathering is 'active' because it involves tools, but the key distinction is whether the target's systems are directly contacted (active) or not (passive).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Passive reconnaissance
Passive reconnaissance involves collecting information about a target from publicly available sources without sending any packets or making direct contact with the target's systems. This approach relies on open-source intelligence (OSINT) such as WHOIS records, DNS lookups, search engines, and social media, ensuring no footprint is left on the target's network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Vulnerability scanning
Why it's wrong here
Vulnerability scanning is an active technique that directly interacts with systems.
- ✗
Social engineering
Why it's wrong here
Social engineering involves manipulating people, not just using public sources.
- ✗
Active reconnaissance
Why it's wrong here
Active reconnaissance involves direct interaction with the target, such as scanning or probing.
- ✓
Passive reconnaissance
Why this is correct
Passive reconnaissance uses publicly available information without direct interaction.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst wants to gather information about a target domain without directly interacting with its systems. Which technique would be MOST appropriate?
easy- A.Send ICMP echo requests to the target network
- B.Run a vulnerability scan with Nessus
- C.Perform a port scan using Nmap SYN scan
- ✓ D.Query WHOIS databases for domain registration information
Why D: Querying WHOIS databases is a passive reconnaissance technique that retrieves publicly available domain registration information (e.g., registrar, creation/expiration dates, name servers, and administrative contacts) without sending any packets to the target's systems. This aligns with the goal of gathering information without direct interaction, as defined in the CEH footprinting phase.
Variation 2. A security analyst wants to gather information about a target domain without sending any packets to the target. Which technique should the analyst use?
easy- A.Ping sweep
- ✓ B.WHOIS lookup
- C.Netcat banner grab
- D.Nmap SYN scan
Why B: WHOIS lookup is a passive reconnaissance technique that queries public databases (e.g., RDAP or WHOIS servers) for domain registration details such as registrar, creation date, and administrative contacts. It requires no packets to be sent to the target domain's infrastructure, making it ideal for information gathering without direct interaction.
Variation 3. A security analyst wants to gather information about a target domain using public records without directly interacting with the target's systems. Which technique is the analyst employing?
easy- A.Vulnerability scanning
- ✓ B.OSINT using WHOIS queries
- C.Active reconnaissance
- D.Social engineering
Why B: OSINT (Open Source Intelligence) using WHOIS queries is a passive reconnaissance technique that gathers domain registration details from public WHOIS databases without interacting with the target's systems. This aligns with the requirement to use public records and avoid direct contact, making it the correct choice for footprinting.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.