CEH Footprinting and Reconnaissance Practice Question
Which TWO of the following tools are specifically designed for footprinting and reconnaissance tasks? (Select two.)
⚠ Common exam trap
EC-Council often tests the distinction between active and passive reconnaissance tools, and the trap here is that candidates confuse Nmap (active scanning) with footprinting tools, or think Metasploit's auxiliary modules qualify as reconnaissance, when the exam specifically classifies Shodan and Maltego as dedicated footprinting tools.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Shodan
Shodan is a search engine specifically designed for footprinting and reconnaissance by scanning and indexing internet-connected devices, such as IoT devices, servers, and industrial control systems. It allows attackers to gather information about open ports, services, and banners without direct interaction with the target, making it a primary tool for passive reconnaissance in the CEH context.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Shodan
Why this is correct
Shodan is a specialized search engine that passively collects and indexes banner information from internet-connected devices, services, and industrial control systems worldwide. It allows ethical hackers to perform reconnaissance by searching for specific device types, open ports, software versions, and potential vulnerabilities without directly interacting with the target. This passive data collection makes it an excellent tool for initial footprinting, providing valuable insights into a target's external attack surface.
- ✗
Nmap
Why it's wrong here
Nmap (Network Mapper) is a powerful, open-source utility primarily used for active network discovery and security auditing. While it can gather extensive information like host availability, open ports, operating systems, and service versions, its methodology involves sending packets directly to the target network. This active interaction generates network traffic that can be detected by intrusion detection systems (IDS), making it less suitable for the initial, passive footprinting phase where the goal is to remain undetected.
- ✓
Maltego
Why this is correct
Maltego is a sophisticated graphical link analysis tool designed for open-source intelligence (OSINT) gathering and visualizing relationships between various entities. It automates the collection of publicly available information from diverse sources, including DNS records, WHOIS data, social media, and search engines. By mapping these connections between individuals, organizations, domains, and other digital assets, Maltego provides a comprehensive visual representation crucial for in-depth footprinting and understanding a target's ecosystem.
- ✗
Metasploit
Why it's wrong here
Metasploit Framework is a comprehensive penetration testing platform primarily used for developing, testing, and executing exploit code against remote target systems. Its core functionality revolves around vulnerability exploitation, payload generation, and post-exploitation activities, such as gaining access, maintaining persistence, and privilege escalation. While it is an indispensable tool in later stages of a penetration test, its purpose is not initial, passive information gathering or footprinting.
- ✗
John the Ripper
Why it's wrong here
John the Ripper is a widely recognized, open-source password cracking utility specifically engineered to detect weak passwords or recover lost ones. It operates by performing various types of attacks, including dictionary, brute-force, and hybrid attacks, against password hashes obtained from target systems. Its function is exclusively focused on credential compromise, which is a post-exploitation activity, and therefore it is not a tool used for the initial reconnaissance or footprinting phase.
Go deeper
Related to this question
Learn chapter
Footprinting and Reconnaissance
Key term
Nmap Scanning
Nmap scanning is a method used to discover devices running on a network and find open ports, services, and security weaknesses.
Key term
Covering Tracks
Covering tracks is the process attackers use to hide their activity and remove evidence of a security breach after gaining unauthorized access to a system.
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.