Reconnaissance, Footprinting, and OSINT Techniques EHE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which tool is commonly used for OSINT to gather information about a domain name?

   • AMetasploit
   • BWHOIS lookup
   • CNmap
   • DWireshark
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A junior penetration tester is documenting the footprinting process for a new engagement. The tester has already collected domain registration details, employee information from social media, and the technologies listed in the target's job postings. According to a systematic footprinting methodology, what should the tester do next?

   • AImmediately report the findings to the client without further analysis.
   • BOrganize the collected data and analyze it to identify potential attack vectors and gaps in the profile.
   • CBegin active scanning of the target's network to identify live hosts and open ports.
   • DDiscard any data that seems irrelevant to network security, such as employee names.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is tasked with gathering initial information about a target organization without alerting the target. The analyst needs to identify the organization's domain names, IP address ranges, and key personnel. Which approach best satisfies the requirement of avoiding direct interaction with the target?

   • ASend phishing emails to employees to elicit information about internal network structure.
   • BSearch public WHOIS databases, review the organization's website, and examine social media profiles for employee information.
   • CUse a network scanner to enumerate open ports on the target's web server and banner grab the services.
   • DQuery the target's DNS servers for zone transfers and perform a ping sweep of the identified IP ranges.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which information collection method involves tricking employees into revealing sensitive information?

   • ADNS lookup
   • BWHOIS query
   • CSearch engine query
   • DSocial engineering
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A penetration tester is planning the reconnaissance phase for a client engagement. The client has a strict policy that no traffic should be sent to their production systems during the initial assessment. However, the tester needs to gather information about the client's public-facing infrastructure. Which reconnaissance strategy is most appropriate under this policy?

   • AConnect to the client's VPN and perform internal network scans.
   • BPerform a ping sweep of the client's public IP range to identify live hosts.
   • CUse passive techniques such as WHOIS, DNS lookups, and search engine queries to collect information.
   • DUse a vulnerability scanner to check for known vulnerabilities in the client's web application.
   Reveal Solution Discussion Select an answer first