A penetration tester is tasked with gathering email addresses of employees at a target company for a social engineering campaign. The company has a website with a 'Contact Us' page, a public employee directory, and a careers page. Which method would be the most efficient and effective for harvesting email addresses?

Perform a DNS enumeration to find mail servers and guess email addresses based on common patterns.

Send a test email to a guessed address and monitor for bounce messages.

Query the Whois record for the domain to find the registrant's email address.

Use a web scraper to extract email addresses from the company's public website and social media profiles.

You are conducting a social engineering assessment for a client. You need to gather email addresses of employees from public sources. Which combination of methods would provide the most comprehensive coverage while remaining passive?

Using a tool to brute-force email addresses based on common patterns

Searching the company website, social media profiles, and public job postings

Sending a test email to the company's helpdesk to observe the auto-reply

Querying the company's DNS server for TXT records

A security analyst is reviewing an email that was flagged as suspicious. The email contains an embedded image that is loaded from an external URL. The analyst notices that the email was opened, and the image was fetched from the external server. What is the most likely purpose of this embedded image?

To verify the recipient's email address is valid

To bypass spam filters by making the email appear legitimate

To track whether the recipient opened the email and their IP address

What is a DNS zone transfer?

A method to change the IP address of a domain

A technique to hide DNS queries from network monitoring

A process where a secondary DNS server copies the entire zone file from a primary server

A process to convert a domain name into an IP address

EC-CouncilCertified Ethical Hacker

Domain 2Objective 2

Whois, DNS and Email Footprinting CEH Practice Questions (Page 2)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

11concepts

Questions 6–10

6application · medium
A penetration tester is tasked with gathering email addresses of employees at a target company for a social engineering campaign. The company has a website with a 'Contact Us' page, a public employee directory, and a careers page. Which method would be the most efficient and effective for harvesting email addresses?
Select an answer first
7application · medium
You are conducting a social engineering assessment for a client. You need to gather email addresses of employees from public sources. Which combination of methods would provide the most comprehensive coverage while remaining passive?
Select an answer first
8application · medium
A network administrator is troubleshooting email delivery issues for the domain 'example.com'. Users report that emails sent to external recipients are sometimes delayed or rejected. The administrator wants to verify that the domain's mail configuration is correct. Which DNS record type should the administrator check first?
Select an answer first
9application · medium
A security analyst is reviewing an email that was flagged as suspicious. The email contains an embedded image that is loaded from an external URL. The analyst notices that the email was opened, and the image was fetched from the external server. What is the most likely purpose of this embedded image?
Select an answer first
10foundation · easy
What is a DNS zone transfer?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Whois, DNS and Email Footprinting CEH Practice Questions (Page 2)

Questions 6–10

You are conducting a social engineering assessment for a client. You need to gather email addresses of employees from public sources. Which combination of methods would provide the most comprehensive coverage while remaining passive?

What is a DNS zone transfer?

Keep studying — Reconnaissance Techniques