During a penetration test, you are tasked with discovering the internal IP addressing scheme of a target organization. You have identified a public-facing web server that hosts a file named 'backup_config.txt' in its root directory, which is indexed by search engines. You also know the organization's domain name. Which combination of techniques would most efficiently reveal the internal network structure?

Use a search engine query to locate the indexed backup file, then download it and analyze its contents for internal IP addresses and network ranges.

Run a ping sweep against the public IP range of the web server to identify active internal hosts.

Perform a WHOIS lookup on the domain to obtain the registered name servers, then query those name servers for internal host records.

Use a traceroute to the web server and analyze the hops to infer the internal subnet mask.

You are performing OSINT for a client. You need to find any publicly available documents that might contain sensitive information about the client's internal operations. Which search engine query would be most effective?

intitle:index of site:clientdomain.com

link:clientdomain.com filetype:html

inurl:admin site:clientdomain.com

site:clientdomain.com filetype:docx OR filetype:xlsx OR filetype:pdf

EC-CouncilCertified Ethical Hacker

Domain 2Objective 1

Footprinting and OSINT CEH Practice Questions (Page 10)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

9concepts

Questions 46–48

46application · medium
During a penetration test, you are tasked with discovering the internal IP addressing scheme of a target organization. You have identified a public-facing web server that hosts a file named 'backup_config.txt' in its root directory, which is indexed by search engines. You also know the organization's domain name. Which combination of techniques would most efficiently reveal the internal network structure?
Select an answer first
47application · medium
You are performing OSINT for a client. You need to find any publicly available documents that might contain sensitive information about the client's internal operations. Which search engine query would be most effective?
Select an answer first
48foundation · easy
Which of the following is an example of an open-source intelligence (OSINT) tool commonly used for footprinting?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Footprinting and OSINT CEH Practice Questions (Page 10)

Questions 46–48

You are performing OSINT for a client. You need to find any publicly available documents that might contain sensitive information about the client's internal operations. Which search engine query would be most effective?

Which of the following is an example of an open-source intelligence (OSINT) tool commonly used for footprinting?

Keep studying — Reconnaissance Techniques