During a website footprinting engagement, a security analyst is reviewing the target's public website to identify the technology stack and potential information leaks. The analyst wants to extract metadata from documents and discover hidden files or directories. Which approach is most appropriate?

Use the `robots.txt` file to locate disallowed directories and then download documents from those directories to analyze their metadata

Run a web crawler to index all publicly accessible pages and then use a tool like FOCA to extract metadata from any downloadable documents

Perform a DNS lookup to identify the hosting provider and then use that information to guess the technology stack

Send a series of HTTP requests with different User-Agent strings to see how the server responds and infer the web server software

A penetration tester is performing passive reconnaissance on a target organization. The tester has identified the domain `example.com` and wants to discover additional subdomains and internal network ranges without directly interacting with the target's systems. Which combination of techniques would be most effective for this task?

Using search engines with site: filters and querying public DNS records for the domain

Using social media profiling to find IT staff posts that mention internal IP addresses

Performing a ping sweep of the entire public IP space and then running traceroute to each responsive host

Querying the WHOIS database for the domain and using DNS zone transfer attempts

What is the primary goal of competitive intelligence gathering in the context of ethical hacking?

To sabotage a competitor's infrastructure

To steal trade secrets from a competitor

To understand a competitor's strategies, strengths, and weaknesses to gain a business advantage

To identify vulnerabilities in a competitor's systems for direct exploitation

During a website footprinting exercise, you notice that the target website's page source contains comments with the names of developers and internal server paths. Which countermeasure should the organization implement to reduce this exposure?

Disable directory browsing on the web server.

Remove or sanitize HTML comments and ensure that error messages do not reveal internal paths.

Use a CDN to hide the server's IP address.

Implement DNSSEC to prevent DNS spoofing.

EC-CouncilCertified Ethical Hacker

Domain 2Objective 1

Footprinting and OSINT CEH Practice Questions (Page 2)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

9concepts

Questions 6–10

6application · medium
During a website footprinting engagement, a security analyst is reviewing the target's public website to identify the technology stack and potential information leaks. The analyst wants to extract metadata from documents and discover hidden files or directories. Which approach is most appropriate?
Select an answer first
7application · medium
A penetration tester is performing passive reconnaissance on a target organization. The tester has identified the domain `example.com` and wants to discover additional subdomains and internal network ranges without directly interacting with the target's systems. Which combination of techniques would be most effective for this task?
Select an answer first
8foundation · easy
Which Google search operator is used to search for a specific file type, such as PDF or DOCX?
Select an answer first
9foundation · easy
What is the primary goal of competitive intelligence gathering in the context of ethical hacking?
Select an answer first
10application · medium
During a website footprinting exercise, you notice that the target website's page source contains comments with the names of developers and internal server paths. Which countermeasure should the organization implement to reduce this exposure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Footprinting and OSINT CEH Practice Questions (Page 2)

Questions 6–10

During a website footprinting engagement, a security analyst is reviewing the target's public website to identify the technology stack and potential information leaks. The analyst wants to extract metadata from documents and discover hidden files or directories. Which approach is most appropriate?

Which Google search operator is used to search for a specific file type, such as PDF or DOCX?

What is the primary goal of competitive intelligence gathering in the context of ethical hacking?

During a website footprinting exercise, you notice that the target website's page source contains comments with the names of developers and internal server paths. Which countermeasure should the organization implement to reduce this exposure?

Keep studying — Reconnaissance Techniques