CEH Footprinting, Reconnaissance and Scanning Practice Question
Which THREE of the following are examples of OSINT techniques? (Choose 3)
⚠ Common exam trap
EC-Council often tests the distinction between active and passive reconnaissance, and the trap here is that candidates confuse tools that can be used for both (like Nmap) with OSINT, forgetting that OSINT specifically excludes any direct interaction with the target system.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Shodan search
Shodan is a search engine for internet-connected devices, allowing users to discover open ports, services, and banners without directly interacting with the target. This is a classic OSINT technique because it gathers publicly available information from external sources, not from active scanning of the target's own infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Nmap version detection
Why it's wrong here
Nmap version detection is an active reconnaissance technique because it involves sending specially crafted packets to a target system and analyzing its responses to identify service versions. This direct interaction with the target, which actively probes network services and ports, fundamentally differentiates it from passive OSINT, which relies solely on publicly available information without engaging the target network.
- ✓
Shodan search
Why this is correct
Shodan is a powerful OSINT search engine that passively collects information about internet-connected devices, services, and their configurations by continuously scanning the entire internet. Users can then query this vast database to discover exposed ports, vulnerable services, and device metadata without directly interacting with the target, making it a prime example of open-source intelligence.
- ✓
Maltego graph analysis
Why this is correct
Maltego facilitates OSINT by aggregating disparate public data sources, such as DNS records, social media profiles, and domain registrations, into a visual graph format. This allows analysts to uncover hidden relationships and connections between entities like individuals, organizations, and infrastructure, all derived from publicly accessible information without direct target engagement.
- ✗
Nessus vulnerability scan
Why it's wrong here
Nessus performs active vulnerability scanning by directly probing target systems with various network requests and authentication attempts to identify security weaknesses. Unlike OSINT, which gathers information passively from public sources, Nessus actively interacts with the target's network and services, often requiring credentials or specific network access to execute its comprehensive checks.
- ✓
Google dorking
Why this is correct
Google dorking, also known as Google hacking, is an OSINT technique that leverages advanced search operators (dorks) within search engines like Google to uncover sensitive, publicly indexed information. This can include exposed configuration files, directory listings, login portals, or private documents that were inadvertently left accessible on websites, all without directly interacting with the target server.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.