A penetration tester is conducting a social engineering footprinting exercise against a target organization. The tester wants to gather information about employees' roles, email addresses, and potential security questions. Which technique would be most effective and ethical?

Send phishing emails to employees to trick them into revealing information

Create a fake social media profile and send friend requests to employees to gather personal information

Use LinkedIn and other public professional networks to gather employee information and infer email patterns

Call the help desk and pretend to be an employee to reset a password

What type of information is typically obtained from a WHOIS lookup?

The domain registrar and registration date

The open ports on the target's server

The operating system of the target's server

The IP address of the target's web server

Which of the following techniques is used to extract metadata from publicly accessible documents on a target website?

Performing a ping sweep on the web server

Using the 'view source' option in a web browser

Using a tool like FOCA or ExifTool

A security consultant is performing network footprinting for a client. The client has provided the domain `example.com` and wants to identify the public IP ranges and active hosts. The consultant wants to minimize the risk of detection. Which approach should be used?

Use public DNS databases and search engines to find subdomains and IP addresses, then use a passive OSINT tool to map the network

Use DNS queries to resolve subdomains and then perform a traceroute to each resolved IP

Use WHOIS to get the IP range and then perform a ping sweep with a long timeout

Use a ping sweep with spoofed source IP addresses to avoid detection

EC-CouncilCertified Ethical Hacker

Domain 2Objective 1

Footprinting and OSINT CEH Practice Questions (Page 6)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

9concepts

Questions 26–30

26application · medium
A penetration tester is conducting a social engineering footprinting exercise against a target organization. The tester wants to gather information about employees' roles, email addresses, and potential security questions. Which technique would be most effective and ethical?
Select an answer first
27foundation · easy
Which of the following is a common social media platform used for profiling employees during footprinting?
Select an answer first
28foundation · easy
What type of information is typically obtained from a WHOIS lookup?
Select an answer first
29foundation · easy
Which of the following techniques is used to extract metadata from publicly accessible documents on a target website?
Select an answer first
30application · medium
A security consultant is performing network footprinting for a client. The client has provided the domain `example.com` and wants to identify the public IP ranges and active hosts. The consultant wants to minimize the risk of detection. Which approach should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.