During a website footprinting exercise, you want to identify the content management system (CMS) and web server software used by a target site, as well as any plugins or themes. Which method would be most reliable?

Use a ping sweep to identify the operating system of the web server.

Run a traceroute to the server and analyze the response times to infer the server hardware.

Perform a WHOIS lookup on the domain to determine the hosting provider and server type.

Inspect the HTTP response headers and page source code for generator meta tags, script paths, and comments.

A penetration tester is performing social engineering footprinting on a target organization. The tester wants to identify potential employees who might be susceptible to phishing attacks. Which approach is most effective and ethical?

Use a tool to scrape the target's website for employee email addresses and then send them a phishing email

Call the target's help desk and ask for a list of employees and their roles

Use a search engine to find employee reviews of the company on job sites

Analyze public social media profiles to identify employees who frequently post about their work and personal interests

A company wants to reduce its exposure to footprinting attacks. The security team is reviewing the company's public web presence and DNS records. Which countermeasure would be most effective in minimizing information leakage?

Use a CDN to hide the origin server IP and implement rate limiting on the web server

Disable directory listing on the web server and remove the `robots.txt` file

Remove all documents from the website that contain metadata, such as PDFs and Office files

Use a privacy service for WHOIS registration and restrict DNS zone transfers

You are performing footprinting on a target domain. You want to discover the IP address of the mail server and the name servers responsible for the domain. Which DNS query type would you use?

Perform a reverse DNS lookup on the domain's IP range.

Perform an MX record query and an NS record query for the domain.

Perform an A record query for the domain and a WHOIS lookup.

Perform a TXT record query and a CNAME query.

You are a security consultant hired to perform a red team exercise. The client has given you permission to use any publicly available information. You need to create a detailed profile of the target organization's employees, including their roles, contact details, and potential personal interests, to plan a vishing attack. The client has also asked you to minimize the risk of alerting the target. Which approach best balances effectiveness and stealth?

Perform a ping sweep on the target's public IP range to identify internal hosts and infer employee roles from hostnames.

Use WHOIS and DNS queries to find employee email addresses and phone numbers.

Send a phishing email to a few employees to gather more detailed information about the organization.

Use passive OSINT sources such as LinkedIn, company website, and public social media profiles to build employee profiles.

EC-CouncilCertified Ethical Hacker

Domain 2Objective 1

Footprinting and OSINT CEH Practice Questions (Page 7)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

9concepts

Questions 31–35

31application · medium
During a website footprinting exercise, you want to identify the content management system (CMS) and web server software used by a target site, as well as any plugins or themes. Which method would be most reliable?
Select an answer first
32application · medium
A penetration tester is performing social engineering footprinting on a target organization. The tester wants to identify potential employees who might be susceptible to phishing attacks. Which approach is most effective and ethical?
Select an answer first
33application · medium
A company wants to reduce its exposure to footprinting attacks. The security team is reviewing the company's public web presence and DNS records. Which countermeasure would be most effective in minimizing information leakage?
Select an answer first
34application · medium
You are performing footprinting on a target domain. You want to discover the IP address of the mail server and the name servers responsible for the domain. Which DNS query type would you use?
Select an answer first
35expert · hard
You are a security consultant hired to perform a red team exercise. The client has given you permission to use any publicly available information. You need to create a detailed profile of the target organization's employees, including their roles, contact details, and potential personal interests, to plan a vishing attack. The client has also asked you to minimize the risk of alerting the target. Which approach best balances effectiveness and stealth?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.