CEH Footprinting, Reconnaissance and Scanning Practice Question

Which TWO of the following are passive reconnaissance techniques? (Select 2)

⚠ Common exam trap

EC-Council often tests the distinction between passive and active reconnaissance by including banner grabbing (which is active because it requires a direct connection) as a distractor, leading candidates to mistakenly classify it as passive since it only reads server responses.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Performing a WHOIS lookup

A WHOIS lookup queries public databases (e.g., whois.arin.net) to retrieve registration details for domains or IP blocks, such as registrar, creation date, and administrative contacts. This is passive because it relies on publicly available information without sending any packets directly to the target system. The CEH defines passive reconnaissance as gathering data without interacting with the target's network or services.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Performing a WHOIS lookup
Why this is correct
Performing a WHOIS lookup is a classic passive reconnaissance technique because it queries publicly available domain registration databases. This process retrieves information such as domain registrant details, administrative and technical contacts, and nameserver information without sending any packets directly to the target's network infrastructure. The interaction occurs solely with the WHOIS server, which acts as a third-party information source, making it undetectable by the target.
✗
Banner grabbing with Netcat
Why it's wrong here
Banner grabbing with Netcat involves establishing a direct TCP connection to a specific port on the target system, such as port 80 for HTTP or port 22 for SSH. This direct interaction sends packets to the target's network and solicits a response, often revealing service versions or operating system details. Because it requires direct communication and elicits a response from the target, it is unequivocally an active reconnaissance method.
✗
Running a TCP SYN scan with Nmap
Why it's wrong here
Running a TCP SYN scan with Nmap is a highly active reconnaissance technique, as it involves sending specially crafted SYN packets to various ports on the target host. The scanner then analyzes the target's response (SYN/ACK for open, RST for closed) to determine port states. Even though it's often called a "stealth scan" because it doesn't complete the full TCP handshake, it still directly interacts with the target's network stack and can be detected by intrusion detection systems.
✓
Using Shodan to search for exposed devices
Why this is correct
Utilizing Shodan to search for exposed devices constitutes passive reconnaissance because Shodan operates as a search engine that continuously scans the internet and indexes information about internet-connected devices. When a user queries Shodan, they are interacting solely with Shodan's pre-collected database, not sending any traffic to the actual target systems. This method allows for discovery of open ports, services, and vulnerabilities without alerting the target organization to the reconnaissance efforts.
✗
Performing a ping sweep
Why it's wrong here
Performing a ping sweep is an active reconnaissance technique designed to identify live hosts on a network. It involves sending Internet Control Message Protocol (ICMP) echo request packets to a range of IP addresses and waiting for ICMP echo reply packets. This direct transmission of packets to potential targets and the expectation of a response constitutes active probing, which can be easily logged and detected by network monitoring tools and firewalls.

Go deeper

CEH Footprinting, Reconnaissance and Scanning Practice Question

Why each option matters

Option-by-option breakdown

Related to this question