CEH Footprinting, Reconnaissance and Scanning Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Ping sweep

  Why it's wrong here

  A ping sweep is an active reconnaissance technique because it involves sending Internet Control Message Protocol (ICMP) echo requests to a range of IP addresses. This direct interaction with target systems elicits responses, such as ICMP echo replies, which can be detected by intrusion detection systems (IDS) or logged by the target network. The act of sending these probes directly to the target makes it an observable and potentially traceable action.

• ✓

  WHOIS lookup

  Why this is correct

  A WHOIS lookup is a classic example of passive reconnaissance because it involves querying publicly available databases maintained by domain registrars and registries. This process retrieves information such as domain ownership, registration dates, and contact details without sending any packets directly to the target organization's network. Since the interaction is solely with a third-party database, the target system remains unaware of the information gathering attempt.

• ✗

  Banner grabbing with Telnet

  Why it's wrong here

  Banner grabbing using Telnet is an active reconnaissance method as it requires establishing a direct connection to a target system's open port, such as port 23 for Telnet or port 80 for HTTP. By initiating a session and sending specific commands or connection requests, the attacker directly interacts with the service to elicit identifying information like software versions. This direct communication leaves a footprint on the target server's logs, making it detectable.

• ✗

  Port scanning

  Why it's wrong here

  Port scanning is an inherently active reconnaissance technique because it involves sending various types of network packets, such as SYN or ACK flags, to a target host's ports to determine which services are listening. This direct probing of a target's network interfaces generates traffic that can be easily detected by firewalls, intrusion detection systems, and network monitoring tools. The goal is to map the attack surface by identifying open ports, which necessitates direct interaction with the target system.

• ✓

  Google dorking

  Why this is correct

  Google dorking, also known as Google hacking, is a highly effective passive reconnaissance technique that utilizes advanced search operators to find specific, often sensitive, information indexed by search engines. By crafting precise queries, an attacker can uncover publicly exposed documents, directories, or configuration files without ever directly interacting with the target's web servers or network. The information is retrieved from Google's cached data, ensuring complete anonymity from the target's perspective.

Go deeper

Related to this question