CEH Footprinting and Reconnaissance Practice Question
You are a penetration tester for a security firm. Your client, Acme Corp, has requested an external reconnaissance assessment. They have provided their primary domain 'acme.com'. You begin by performing passive footprinting using public sources. After gathering initial information, you want to identify their email servers, subdomains, and any exposed services. You also want to map their network infrastructure without directly interacting with their systems to avoid detection. Which course of action should you take next?
⚠ Common exam trap
EC-Council often tests the distinction between passive and active reconnaissance, and the trap here is that candidates may confuse Shodan (passive) with Nmap (active), or think traceroute is passive because it's a common network diagnostic tool.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Shodan to search for Acme Corp's IP ranges and perform DNS enumeration to discover subdomains and mail servers.
Shodan allows passive identification of exposed services, including email servers and subdomains, by querying its indexed data of internet-facing devices without sending any packets to Acme Corp's systems. DNS enumeration can then be performed passively using public DNS records (e.g., MX, NS, A records) to map subdomains and mail servers, fulfilling the requirement to avoid direct interaction and detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Call Acme Corp's IT help desk posing as an employee to ask about their email server configuration.
Why it's wrong here
Calling the IT help desk and impersonating an employee constitutes active social engineering. This method involves direct human interaction and deception to extract sensitive information, which is highly intrusive and goes beyond passive information gathering. Such actions are typically considered out of scope for initial reconnaissance without explicit, detailed authorization due to their potential ethical and legal ramifications.
- ✓
Use Shodan to search for Acme Corp's IP ranges and perform DNS enumeration to discover subdomains and mail servers.
Why this is correct
Using Shodan to search for IP ranges and performing DNS enumeration are both passive reconnaissance techniques. Shodan queries publicly indexed internet-connected devices, providing information without direct interaction with the target. Similarly, DNS enumeration, when querying public DNS records (e.g., A, MX, NS records), retrieves publicly available information without sending traffic directly to the target's internal network, making it a stealthy and permissible initial step.
- ✗
Perform a traceroute to Acme Corp's web server to map the network path.
Why it's wrong here
Performing a traceroute is an active reconnaissance method because it sends ICMP (or UDP/TCP) packets directly to the target's network infrastructure. These packets traverse multiple routers, each decrementing the Time-To-Live (TTL) value and potentially generating ICMP "Time Exceeded" messages. This direct interaction generates network traffic that can be logged by intermediate devices and the target, leaving a detectable footprint.
- ✗
Run an Nmap scan against the entire IP range of Acme Corp to identify open ports and services.
Why it's wrong here
Running an Nmap scan is a highly active form of reconnaissance that involves sending numerous packets to probe target hosts for open ports, services, and operating system details. This direct, systematic interaction with the target's network services generates significant traffic and can easily trigger network intrusion detection systems (IDS) or firewalls, making it a noisy and detectable activity.
Visual reference
Go deeper
Related to this question
Learn chapter
Footprinting and Reconnaissance
Key term
OSINT Techniques
OSINT techniques are methods used to collect information from publicly available sources for security assessments or investigations.
Key term
DNS enumeration
DNS enumeration is the process of systematically querying a Domain Name System (DNS) server to gather information about a target domain, including its subdomains, IP addresses, and mail server records.
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.