CEH Footprinting, Reconnaissance and Scanning Practice Question
Which of the following OSINT techniques would be MOST effective for discovering email addresses and employee names associated with a target organization?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
theHarvester
theHarvester is specifically designed to gather emails, subdomains, IPs, and employee names from public sources like search engines, PGP key servers, and social networks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Nmap scan
Why it's wrong here
Nmap is an active network scanning tool primarily used for host discovery, port enumeration, and service version detection. It sends packets to target systems, generating network traffic, which makes it unsuitable for passive OSINT. Its function is to map network topology and identify live hosts, not to passively collect email addresses from publicly available sources.
- ✓
theHarvester
Why this is correct
theHarvester is a dedicated OSINT tool specifically designed for gathering publicly available information, including email addresses, subdomains, hostnames, and employee names. It queries various public data sources like search engines (e.g., Google, Bing), PGP key servers, and social media platforms to aggregate this intelligence. This makes it exceptionally effective for passive reconnaissance aimed at collecting target organization email addresses without direct interaction.
- ✗
WHOIS lookup
Why it's wrong here
A WHOIS lookup provides domain registration details, including the registrant's name, organization, contact information, and administrative/technical contacts. While it might occasionally reveal a generic organizational email, it rarely contains specific employee email addresses due to privacy regulations like GDPR and widespread redaction practices. Therefore, it is not an effective primary technique for gathering a broad list of individual employee emails via passive OSINT.
- ✗
Shodan search
Why it's wrong here
Shodan is a specialized search engine for internet-connected devices, allowing users to discover systems based on open ports, banners, and geographical location. Its primary function is to identify exposed services, IoT devices, and network infrastructure components, which is valuable for vulnerability assessment. However, Shodan is not designed to extract or aggregate employee email addresses from public sources, making it ineffective for this specific OSINT objective.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.