CEH Footprinting, Reconnaissance and Scanning Practice Question

Which TWO of the following are passive reconnaissance techniques? (Select 2)

⚠ Common exam trap

EC-Council often tests the distinction between passive and active reconnaissance by making candidates confuse techniques that use public databases (passive) with those that send packets to the target (active); the trap here is that banner grabbing with Netcat feels passive because it only reads a response, but it still requires initiating a TCP connection to the target.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Performing a WHOIS lookup

A WHOIS lookup queries public databases (e.g., ARIN, RIPE) to retrieve domain registration details such as registrar, creation date, and name server records. This is passive because it relies on publicly available information without sending any packets to the target network or interacting with its live systems.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Performing a WHOIS lookup
Why this is correct
Performing a WHOIS lookup is a classic passive reconnaissance technique because it queries publicly available databases maintained by domain registrars and registries. This action retrieves information such as domain owner, administrative contacts, nameservers, and registration dates without sending any packets directly to the target's servers or network. The data is simply pulled from a third-party repository, making it entirely non-intrusive and undetectable by the target.
✗
Running an Nmap version scan
Why it's wrong here
Running an Nmap version scan is an active reconnaissance technique because it directly interacts with services running on the target host. Nmap sends specially crafted probes to open ports and analyzes the responses to identify the application name and version, often using a database of signatures. This direct communication generates network traffic that can be logged and detected by intrusion detection systems (IDS) or firewalls on the target network.
✗
Performing a ping sweep
Why it's wrong here
Performing a ping sweep is an active reconnaissance method as it involves sending ICMP Echo Request packets, or sometimes TCP SYN packets, to a range of IP addresses to identify live hosts on a network. Each probe elicits a direct response from the target if it is online and configured to reply, generating network traffic that is easily detectable by the target's network monitoring tools. This direct interaction makes it a clear example of active scanning.
✓
Using Shodan to find exposed devices
Why this is correct
Using Shodan to find exposed devices is a passive reconnaissance technique because Shodan maintains its own vast database of information collected from continuous, wide-scale internet scans. When an attacker queries Shodan, they are simply searching this pre-existing repository for data related to the target, such as open ports, service banners, and geographical location, without sending any direct traffic to the target's network. This method ensures the target remains unaware of the information gathering attempt.
✗
Banner grabbing with Netcat
Why it's wrong here
Banner grabbing using a tool like Netcat is an active reconnaissance technique because it requires establishing a direct TCP connection to a specific port on the target system. By connecting and sending a simple request, the attacker elicits a service banner containing information about the running application and its version. This direct communication with the target's service generates network traffic and can be logged by the target, making it easily detectable.

Go deeper

CEH Footprinting, Reconnaissance and Scanning Practice Question

Why each option matters

Option-by-option breakdown

Related to this question