Passive Reconnaissance Techniques in Ethical Hacking
Which TWO of the following techniques are considered passive reconnaissance? (Select exactly 2.)
Quick Answer
The answer is WHOIS lookups and using Google dorks to find exposed files. Both techniques are considered passive reconnaissance because they gather information without directly interacting with the target system—WHOIS queries rely on public third-party databases like whois.arin.net, while Google dorks leverage cached search engine results, meaning no packets are sent to the target’s own infrastructure. On the Certified Ethical Hacker CEH exam, this distinction tests your understanding of the reconnaissance phase, where passive techniques avoid alerting intrusion detection systems. A common trap is confusing active tools like Nmap or netcat with passive methods; remember that if you never touch the target’s network, it’s passive. For a quick memory tip, think “third-party sources only”—if the data comes from a public registry or a search engine cache, you’re staying passive.
⚠ Common exam trap
EC-Council often tests the distinction that any technique involving direct interaction with the target's network stack (even a single packet or connection) is active, while passive methods rely on third-party sources or pre-existing data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Performing a WHOIS lookup
A WHOIS lookup queries public databases (e.g., whois.arin.net) to retrieve registration details for domains or IP blocks. This process does not send any packets directly to the target system; it relies on third-party servers, making it a passive reconnaissance technique.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Performing a WHOIS lookup
Why this is correct
WHOIS queries public databases, no direct interaction with target.
- ✗
Connecting to a web server to grab its banner
Why it's wrong here
Connecting to a server is active.
- ✗
Sending ICMP echo requests to a target
Why it's wrong here
Sending packets is active reconnaissance.
- ✓
Using Google dorks to find exposed files
Why this is correct
Google dorks use search engine indexes, no direct contact.
- ✗
Running a Nmap SYN scan
Why it's wrong here
Nmap SYN scan sends packets to the target, active.
Go deeper
Related to this question
Learn chapter
Footprinting and Reconnaissance
Key term
Passive reconnaissance
Passive reconnaissance is the process of gathering information about a target system or network without directly interacting with it, using publicly available sources and stealthy observation.
Key term
WHOIS lookup
WHOIS lookup is a query and response protocol used to search databases that store the registration information of domain names and IP address blocks.
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which of the following techniques is considered PASSIVE reconnaissance?
easy- A.Ping sweeping a subnet
- B.Banner grabbing with Telnet
- C.Running a SYN scan with Nmap
- ✓ D.Performing a WHOIS lookup
Why D: WHOIS queries retrieve domain registration records from public databases like whois.iana.org or RDAP servers. Since the target server is never contacted directly — only public registries are queried — no packets are sent to the target's infrastructure, making it a purely passive reconnaissance technique.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.