Which Techniques Are Passive Reconnaissance? WHOIS, Google Dorking, Shodan
Which TWO of the following are passive reconnaissance techniques?
Quick Answer
The answer is WHOIS lookup and Google dorking. Both are passive reconnaissance techniques because they gather publicly available information without directly interacting with the target’s systems. WHOIS queries access domain registration databases to reveal owner details, email addresses, and name servers, while Google dorking uses advanced search operators to find indexed files or exposed directories on search engines—neither sends packets to the target’s infrastructure. On the Certified Ethical Hacker CEH exam, this distinction tests your understanding of the reconnaissance phase, where passive techniques are defined by zero direct contact; a common trap is confusing active tools like Nmap or netcat with passive methods. Remember the memory tip: if you’re not touching the target’s network, it’s passive—think “search and query, never ping and probe.”
⚠ Common exam trap
Test-takers frequently confuse 'passive' with 'stealthy' and incorrectly classify techniques like banner grabbing or SYN scans as passive because they can be performed with minimal noise, but CEH strictly defines passive reconnaissance as having zero direct interaction with the target's systems.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Google hacking (dorking)
Google hacking (dorking) is a passive reconnaissance technique because it involves using advanced search operators in Google to discover publicly indexed information about a target, such as exposed configuration files or login pages, without sending any packets directly to the target's systems. It relies entirely on the search engine's pre-existing index, making it undetectable and non-intrusive. Similarly, WHOIS lookup is a passive reconnaissance technique because it queries public WHOIS databases to retrieve domain registration information, such as registrant details, name servers, and expiration dates, without directly interacting with the target's own infrastructure. Both techniques align with the CEH definition of passive reconnaissance, where no direct interaction with the target occurs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ping sweep
Why it's wrong here
Ping sweep sends ICMP echo requests, which is active.
- ✓
Google hacking (dorking)
Why this is correct
Google dorking uses search engines to find information passively.
- ✗
Nmap SYN scan
Why it's wrong here
An Nmap SYN scan sends crafted TCP packets and analyses responses, which constitutes active interaction with the target system, thereby disqualifying it as passive reconnaissance. It is tempting because it is a stealthy, non-connection-completing scan that avoids application-layer logging, making it a correct choice for evading detection during active enumeration, but not for passive information gathering.
- ✗
Banner grabbing with Netcat
Why it's wrong here
Banner grabbing requires connecting to the target service, which is active.
- ✓
WHOIS lookup
Why this is correct
WHOIS is a passive query to public databases.
Go deeper
Related to this question
Learn chapter
Introduction to Ethical Hacking
Key term
Covering Tracks
Covering tracks is the process attackers use to hide their activity and remove evidence of a security breach after gaining unauthorized access to a system.
Key term
Passive reconnaissance
Passive reconnaissance is the process of gathering information about a target system or network without directly interacting with it, using publicly available sources and stealthy observation.
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are passive reconnaissance techniques? (Select 2)
easy- ✓ A.Performing a WHOIS lookup
- B.Running an Nmap version scan
- C.Performing a ping sweep
- ✓ D.Using Shodan to find exposed devices
- E.Banner grabbing with Netcat
Why A: A WHOIS lookup queries public databases (e.g., ARIN, RIPE) to retrieve domain registration details such as registrar, creation date, and name server records. This is passive because it relies on publicly available information without sending any packets to the target network or interacting with its live systems.
Variation 2. Which TWO of the following are passive reconnaissance techniques? (Select 2)
medium- ✓ A.Performing a WHOIS lookup
- B.Banner grabbing with Netcat
- C.Running a TCP SYN scan with Nmap
- ✓ D.Using Shodan to search for exposed devices
- E.Performing a ping sweep
Why A: A WHOIS lookup queries public databases (e.g., whois.arin.net) to retrieve registration details for domains or IP blocks, such as registrar, creation date, and administrative contacts. This is passive because it relies on publicly available information without sending any packets directly to the target system. The CEH defines passive reconnaissance as gathering data without interacting with the target's network or services.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.