Which Techniques Are Passive Reconnaissance? WHOIS, Google Dorking, Shodan
Which TWO of the following are passive reconnaissance techniques?
Quick Answer
The answer is WHOIS lookup and Google dorking. Both are passive reconnaissance techniques because they gather publicly available information without directly interacting with the target’s systems. WHOIS queries access domain registration databases to reveal owner details, email addresses, and name servers, while Google dorking uses advanced search operators to find indexed files or exposed directories on search engines—neither sends packets to the target’s infrastructure. On the Certified Ethical Hacker CEH exam, this distinction tests your understanding of the reconnaissance phase, where passive techniques are defined by zero direct contact; a common trap is confusing active tools like Nmap or netcat with passive methods. Remember the memory tip: if you’re not touching the target’s network, it’s passive—think “search and query, never ping and probe.”
⚠ Common exam trap
Test-takers frequently confuse 'passive' with 'stealthy' and incorrectly classify techniques like banner grabbing or SYN scans as passive because they can be performed with minimal noise, but CEH strictly defines passive reconnaissance as having zero direct interaction with the target's systems.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Google hacking (dorking)
Google hacking (dorking) is a passive reconnaissance technique because it involves using advanced search operators in Google to discover publicly indexed information about a target, such as exposed configuration files or login pages, without sending any packets directly to the target's systems. It relies entirely on the search engine's pre-existing index, making it undetectable and non-intrusive. Similarly, WHOIS lookup is a passive reconnaissance technique because it queries public WHOIS databases to retrieve domain registration information, such as registrant details, name servers, and expiration dates, without directly interacting with the target's own infrastructure. Both techniques align with the CEH definition of passive reconnaissance, where no direct interaction with the target occurs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ping sweep
Why it's wrong here
A ping sweep sends ICMP echo requests directly to hosts, so it interacts with the target and is active reconnaissance. It is tempting because it feels like simple discovery, but passive techniques rely on third-party sources such as WHOIS, DNS records and search engines without touching the target.
- ✓
Google hacking (dorking)
Why this is correct
Google hacking queries indexed caches and search-engine metadata, never touching the target's systems, which satisfies the passive constraint of zero direct interaction. Dorks expose filetypes, directory listings and login pages already crawled, so no packets reach the organisation's infrastructure and no IDS or logging records the activity.
- ✗
Nmap SYN scan
Why it's wrong here
An Nmap SYN scan sends crafted TCP packets and analyses responses, which constitutes active interaction with the target system, thereby disqualifying it as passive reconnaissance. It is tempting because it is a stealthy, non-connection-completing scan that avoids application-layer logging, making it a correct choice for evading detection during active enumeration, but not for passive information gathering.
- ✗
Banner grabbing with Netcat
Why it's wrong here
Banner grabbing with Netcat opens a connection to the target and reads its service response, generating traffic that the target can log; that is active reconnaissance. It is tempting because it gathers service version data quietly, but any direct interaction with the target disqualifies it as passive.
- ✓
WHOIS lookup
Why this is correct
WHOIS queries public registry databases for domain ownership and registration details, gathering intelligence without contacting the target's infrastructure. This indirect collection satisfies the stem's passive reconnaissance criterion, distinguishing it from active techniques that probe target systems directly.
Go deeper
Related to this question
Learn chapter
Footprinting and Reconnaissance
Key term
Covering Tracks
Covering tracks is the process attackers use to hide their activity and remove evidence of a security breach after gaining unauthorized access to a system.
Key term
Passive reconnaissance
Passive reconnaissance is the process of gathering information about a target system or network without directly interacting with it, using publicly available sources and stealthy observation.
About these practice questions
One of 913 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are passive reconnaissance techniques? (Select 2)
easy- ✓ A.Performing a WHOIS lookup
- B.Running an Nmap version scan
- C.Performing a ping sweep
- ✓ D.Using Shodan to find exposed devices
- E.Banner grabbing with Netcat
Why A: A WHOIS lookup queries public databases (e.g., ARIN, RIPE) to retrieve domain registration details such as registrar, creation date, and name server records. This is passive because it relies on publicly available information without sending any packets to the target network or interacting with its live systems.
Variation 2. Which TWO of the following are passive reconnaissance techniques? (Select 2)
medium- ✓ A.Performing a WHOIS lookup
- B.Banner grabbing with Netcat
- C.Running a TCP SYN scan with Nmap
- ✓ D.Using Shodan to search for exposed devices
- E.Performing a ping sweep
Why A: A WHOIS lookup queries public databases (e.g., whois.arin.net) to retrieve registration details for domains or IP blocks, such as registrar, creation date, and administrative contacts. This is passive because it relies on publicly available information without sending any packets directly to the target system. The CEH defines passive reconnaissance as gathering data without interacting with the target's network or services.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.