You are conducting a penetration test for a client. The client is concerned about sensitive documents being exposed through search engines. You have identified that a file named 'financial_report_2023.pdf' is indexed by Google. The client wants to know if this file is accessible and if it contains sensitive data. You need to verify this without downloading the file directly to avoid leaving traces. Which approach would be most appropriate?

Perform a WHOIS lookup on the domain to see if the file is listed in the registration records.

Use a search engine query to find the file's metadata, such as author and creation date.

Use Google's cached version of the file to view its contents without directly accessing the target server.

Use a ping sweep to check if the server is up before accessing the file.

An ethical hacker wants to find all web pages on a target domain that contain the word 'password' in the URL. Which search operator combination would be most effective?

site:password inurl:example.com

intitle:password site:example.com

site:example.com inurl:password

You are conducting a social engineering assessment for a client. The goal is to test the effectiveness of employee security awareness. You need to gather enough information about employees to craft a convincing pretext for a phone call. Which approach would be most effective and efficient?

Send a phishing email to all employees asking for their job titles and departments.

Perform a WHOIS lookup to find the CEO's personal phone number.

Use OSINT to collect employee names, job titles, and work email addresses from LinkedIn and the company website.

Run a ping sweep on the company's network to identify which employees are online.

You are performing reconnaissance on a target website. You want to find any publicly accessible files that might contain configuration details or backup data. Which search engine operator would be most effective for this purpose?

site:example.com filetype:bak OR filetype:conf

intitle:index of site:example.com

Your company is planning to launch a new product. You want to gather competitive intelligence about a rival's upcoming product features. Which OSINT technique would be most appropriate?

Monitor the rival's job postings, press releases, and patent filings for clues about new technologies and product directions.

Perform a ping sweep on the rival's public IP range to identify internal servers.

Use a search engine to find the rival's employee email addresses for a phishing campaign.

Query the rival's DNS records to find internal hostnames.

EC-CouncilCertified Ethical Hacker

Domain 2Objective 1

Footprinting and OSINT CEH Practice Questions (Page 9)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

9concepts

Questions 41–45

41expert · hard
You are conducting a penetration test for a client. The client is concerned about sensitive documents being exposed through search engines. You have identified that a file named 'financial_report_2023.pdf' is indexed by Google. The client wants to know if this file is accessible and if it contains sensitive data. You need to verify this without downloading the file directly to avoid leaving traces. Which approach would be most appropriate?
Select an answer first
42foundation · easy
An ethical hacker wants to find all web pages on a target domain that contain the word 'password' in the URL. Which search operator combination would be most effective?
Select an answer first
43application · medium
You are conducting a social engineering assessment for a client. The goal is to test the effectiveness of employee security awareness. You need to gather enough information about employees to craft a convincing pretext for a phone call. Which approach would be most effective and efficient?
Select an answer first
44application · medium
You are performing reconnaissance on a target website. You want to find any publicly accessible files that might contain configuration details or backup data. Which search engine operator would be most effective for this purpose?
Select an answer first
45application · medium
Your company is planning to launch a new product. You want to gather competitive intelligence about a rival's upcoming product features. Which OSINT technique would be most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.