CEH Footprinting and Reconnaissance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Performing a ping sweep on the target network

  Why it's wrong here

  Performing a ping sweep involves sending Internet Control Message Protocol (ICMP) echo request packets directly to hosts on the target network. This direct interaction with the target's systems, which elicits an ICMP echo reply, constitutes active reconnaissance. The target's firewalls or intrusion detection systems could log or detect these probes, making it an active footprinting technique.

• ✗

  Conducting a port scan with Nmap

  Why it's wrong here

  Conducting a port scan with Nmap involves sending specially crafted network packets, such as SYN or UDP probes, directly to specific ports on target hosts. These probes are designed to elicit responses that reveal open ports and running services. Since this directly interacts with the target's network stack and can be detected, it is unequivocally an active footprinting method.

• ✓

  Using Google dorking to find exposed documents

  Why this is correct

  Using Google dorking involves leveraging advanced search operators to query Google's pre-existing index for publicly available information about a target, such as exposed documents or misconfigured servers. The interaction occurs solely with Google's search engine, not directly with the target's systems. This method is passive because it relies on information already indexed by a third party, leaving no direct trace on the target's network.

• ✓

  Examining job postings for technology clues

  Why this is correct

  Examining publicly available job postings is a passive footprinting technique because it involves gathering information that the target organization has voluntarily published for recruitment purposes. This method does not involve any direct network interaction or queries against the target's infrastructure. It simply observes publicly accessible data to infer technology stacks, organizational structure, and potential vulnerabilities without leaving any digital trace on the target.

• ✗

  Brute forcing subdomains via DNS queries

  Why it's wrong here

  Brute forcing subdomains via DNS queries involves systematically attempting to resolve numerous potential subdomain names (e.g., dev.example.com, test.example.com) by sending direct requests to DNS servers. While these requests might go to public resolvers, the intent is to actively query for target-specific, often unlisted, information. This direct querying generates network traffic and can be logged by DNS infrastructure, classifying it as an active reconnaissance method.

Go deeper

Related to this question