Footprinting and OSINT CEH Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A penetration tester is planning a red team exercise. The tester needs to gather initial information about the target organization without being detected. The tester has a limited time window and must balance thoroughness with stealth. Which approach is most appropriate?

   • AUse passive OSINT techniques to gather information from public sources, then use that information to guide later active scanning
   • BPerform active scanning of the target's network to quickly identify open ports and services
   • CUse social engineering to trick employees into revealing network details
   • DUse a combination of active and passive techniques simultaneously to save time
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following best describes the role of footprinting in the reconnaissance phase of an ethical hacking engagement?

   • AIt is the process of creating a detailed map of the target's network topology
   • BIt is the final step of the penetration test where vulnerabilities are reported
   • CIt is the initial step of gathering information to identify the target's security posture and potential attack vectors
   • DIt involves actively scanning the target's network for open ports and services
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   Your organization is planning a social engineering assessment. The target is a mid-sized company. You need to gather information about employees, their roles, and potential personal interests to craft convincing phishing emails. Which OSINT approach would be most effective for this task?

   • APerform a WHOIS lookup on the company's domain to identify the IT administrator's personal email address.
   • BSearch LinkedIn and other professional social networks for employee profiles, job titles, and professional interests.
   • CUse a search engine to find the company's annual report and extract the names of board members only.
   • DRun a traceroute to the company's web server to identify the ISP and physical location of employees.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A business analyst is tasked with gathering competitive intelligence on a rival company. The analyst wants to understand the rival's technology investments and potential vulnerabilities without engaging with the company. Which approach is most appropriate?

   • AMonitor job postings and press releases for technology mentions
   • BPurchase a copy of the rival's internal network diagram from a dark web forum
   • CSend a survey to the rival's employees asking about their technology stack
   • DUse a vulnerability scanner to scan the rival's public IP ranges
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is an effective countermeasure to prevent footprinting?

   • AUsing default error messages
   • BDisabling directory listing on web servers
   • CAllowing anonymous FTP access
   • DPublishing employee contact details on the website
   Reveal Solution Discussion Select an answer first