CEH Footprinting, Reconnaissance and Scanning Practice Question
Which TWO techniques are considered active reconnaissance? (Choose TWO.)
⚠ Common exam trap
Watch out — candidates often confuse 'using a tool that sometimes performs active scanning' (like Shodan, which actively scans on its own) with the user's action being active; the key distinction is whether the user's query directly interacts with the target system.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Port scanning with Nmap
Port scanning with Nmap (Option C) is active reconnaissance because it sends crafted packets (e.g., TCP SYN, UDP probes) directly to target systems and analyzes the responses to determine open ports, running services, and operating system details. Banner grabbing with Netcat (Option D) is also active reconnaissance as it establishes a TCP connection to a target service (e.g., HTTP, FTP) and reads the service banner, which involves direct interaction with the target. Both techniques generate detectable network traffic and can be logged by intrusion detection systems.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Using Google dorking to find exposed files
Why it's wrong here
Google dorking is a passive reconnaissance technique because it relies on search engine indexes to discover information. It involves crafting specific queries to find publicly accessible files, directories, or sensitive data that search engine crawlers have already indexed from target websites. This method does not involve direct interaction with the target's systems or network infrastructure, making it entirely non-intrusive from the target's perspective.
- ✗
Querying Shodan for exposed devices
Why it's wrong here
Querying Shodan is considered passive reconnaissance as it involves searching a pre-compiled database of internet-connected devices and services. Shodan continuously scans the internet, collecting banner information and metadata from various ports and protocols, then indexes this data. When a user queries Shodan, they are interacting solely with Shodan's database, not sending any packets or probes directly to the target organization's network, thus avoiding direct interaction.
- ✓
Port scanning with Nmap
Why this is correct
Port scanning with Nmap is a quintessential active reconnaissance technique because it involves sending specially crafted packets directly to a target host. Nmap probes specific TCP or UDP ports to determine their state (open, closed, filtered) and identify running services. This direct interaction generates network traffic that the target's firewalls or intrusion detection systems can log, making it detectable and undeniably active.
- ✓
Banner grabbing with Netcat
Why this is correct
Banner grabbing using tools like Netcat is an active reconnaissance method as it requires establishing a direct connection to a target service on a specific port. By connecting and often sending a simple request (like an HTTP GET or an empty line), the service responds with its banner, revealing software versions and configurations. This direct communication with the target's running services constitutes active interaction, as it generates network traffic and potential logs on the target system.
- ✗
Performing a WHOIS lookup
Why it's wrong here
Performing a WHOIS lookup is a passive reconnaissance technique because it queries publicly available registration databases for domain names and IP addresses. These databases contain information such as registrant contact details, administrative contacts, and registration dates. The lookup process interacts solely with the WHOIS server, which is a public information repository, and does not send any traffic or probes directly to the target organization's network infrastructure.
Visual reference
Go deeper
Related to this question
Learn chapter
Footprinting and Reconnaissance
Key term
Nmap Scanning
Nmap scanning is a method used to discover devices running on a network and find open ports, services, and security weaknesses.
Key term
Active reconnaissance
Active reconnaissance is the process of directly interacting with a target system or network to gather information, often through scanning and probing.
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.