CEH Footprinting, Reconnaissance and Scanning Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Querying Shodan for open ports on a target

  Why it's wrong here

  Querying Shodan for open ports on a target is considered passive reconnaissance because it involves interacting solely with Shodan's pre-collected database, which aggregates information from previous scans performed by Shodan itself. The attacker does not send any packets directly to the target system, thus avoiding direct interaction that could be logged or detected by the target's security mechanisms. This method leverages existing public data without generating new network traffic towards the target, making it undetectable by the target.

• ✓

  Running an Nmap SYN scan against a target

  Why this is correct

  Running an Nmap SYN scan against a target is a definitive example of active reconnaissance because it directly interacts with the target system by sending TCP SYN packets. The target's response, whether a SYN-ACK for open ports or an RST for closed ones, provides real-time information about its network services and host status. This direct packet exchange generates network traffic that originates from the attacker and terminates at the target, making it detectable by intrusion detection systems (IDS) or firewalls.

• ✗

  Searching for sensitive files using Google dorks

  Why it's wrong here

  Searching for sensitive files using Google dorks is a form of passive reconnaissance because it relies entirely on information already indexed by search engines like Google. The attacker crafts specific search queries to uncover publicly available data, cached content, or misconfigured server directories without ever sending a single request directly to the target's web server or network infrastructure. This method exploits publicly accessible search engine databases rather than probing the target directly, ensuring no direct interaction.

• ✗

  Performing a WHOIS lookup

  Why it's wrong here

  Performing a WHOIS lookup is classified as passive reconnaissance because it involves querying a public WHOIS database for domain registration information. This database contains details such as registrant contact information, domain creation/expiration dates, and nameservers, which are publicly available records. The interaction occurs solely with the WHOIS server, which is a public registry, and does not establish any direct network connection or send any packets to the target domain's actual servers or infrastructure.

• ✓

  Using Netcat to grab banners from a web server

  Why this is correct

  Using Netcat to grab banners from a web server is an example of active reconnaissance because it establishes a direct TCP connection to the target server on a specific port, typically 80 or 443. By sending a crafted request, such as an HTTP GET, Netcat directly interacts with the web server to retrieve its banner, which often reveals software versions and operating system details. This direct network communication generates traffic that originates from the attacker's system and terminates at the target, making it detectable by the target's security controls.

Go deeper

Related to this question