Which of the following is a legitimate source for competitive intelligence?

A competitor's employee database

A competitor's source code repository

A competitor's internal email server

You are mapping a target's network infrastructure. You have the domain name and know that the organization uses multiple subdomains for different services. You want to discover all subdomains and their associated IP addresses. Which approach would be most comprehensive?

Query the domain's NS records to find all subdomains.

Perform a WHOIS lookup to get a list of all subdomains.

Use a combination of DNS brute-forcing, search engine queries, and certificate transparency logs to enumerate subdomains.

Use a ping sweep on the main domain's IP range to identify subdomain servers.

A security team is implementing countermeasures to reduce the risk of footprinting. The team has limited resources and must prioritize. The company's main concerns are protecting employee information and preventing the enumeration of internal network structure. Which countermeasure should be implemented first?

Use a CDN to hide the origin server IP

Implement WHOIS privacy and restrict DNS zone transfers

Disable directory listing on all web servers

Remove all metadata from documents published on the website

What is a recommended countermeasure to minimize the risk of information leakage through WHOIS records?

Using multiple domain registrars

Disabling WHOIS lookups entirely

Registering the domain under a fake name

Using a privacy protection service for domain registration

In the context of ethical hacking, what is the primary purpose of footprinting?

To actively exploit vulnerabilities in the target's systems

To gather as much information as possible about the target before any attack

To establish a covert communication channel with the target

To remove traces of an attack from the target's logs

EC-CouncilCertified Ethical Hacker

Domain 2Objective 1

Footprinting and OSINT CEH Practice Questions (Page 3)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

9concepts

Questions 11–15

11foundation · easy
Which of the following is a legitimate source for competitive intelligence?
Select an answer first
12expert · hard
You are mapping a target's network infrastructure. You have the domain name and know that the organization uses multiple subdomains for different services. You want to discover all subdomains and their associated IP addresses. Which approach would be most comprehensive?
Select an answer first
13expert · hard
A security team is implementing countermeasures to reduce the risk of footprinting. The team has limited resources and must prioritize. The company's main concerns are protecting employee information and preventing the enumeration of internal network structure. Which countermeasure should be implemented first?
Select an answer first
14foundation · easy
What is a recommended countermeasure to minimize the risk of information leakage through WHOIS records?
Select an answer first
15foundation · easy
In the context of ethical hacking, what is the primary purpose of footprinting?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.