Reconnaissance, Footprinting, and OSINT Techniques EHE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A network security team is conducting an authorized penetration test on their own infrastructure. They need to identify which services are running on a specific server to prioritize patching. The team is allowed to interact with the server but wants to avoid crashing any services. Which active reconnaissance technique is most appropriate?

   • APerform a TCP connect scan on common ports to identify open services.
   • BQuery the server's SNMP service for a list of running services.
   • CSend a series of malformed packets to the server to see how it responds.
   • DUse a UDP scan on all 65,535 ports to find any UDP services.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security analyst is conducting passive reconnaissance on a target organization. The analyst has collected data from social media, job postings, and public financial reports. The analyst notices that the organization uses a specific ERP system and has recently posted job openings for administrators of that system. How should the analyst apply this information?

   • AReport the findings to the client without further analysis.
   • BUse the ERP system name and version to search for known vulnerabilities and potential attack vectors.
   • CContact the organization's HR department to confirm the ERP system version.
   • DIgnore the job postings because they are not directly related to the network infrastructure.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which activity is an example of passive reconnaissance?

   • ASearching public records for company information
   • BConnecting to a target's web server to enumerate directories
   • CPerforming a port scan on the target's firewall
   • DSending ICMP echo requests to a target server
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A penetration tester is conducting active reconnaissance on a target network. The tester has already identified the target's IP address range from passive footprinting. The tester now wants to determine which hosts are alive and which services are running on them. Which technique should the tester use first?

   • ARun a port scan on the entire IP range.
   • BUse a vulnerability scanner to check for known vulnerabilities.
   • CQuery the target's DNS server for a zone transfer.
   • DPerform a ping sweep to identify live hosts.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which technique is considered active reconnaissance?

   • AReviewing public financial reports
   • BBrowsing the target's public website
   • CSearching social media for employee names
   • DPerforming a ping sweep to identify live hosts
   Reveal Solution Discussion Select an answer first