Reconnaissance, Footprinting, and OSINT Techniques EHE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst is performing passive reconnaissance on a target organization. The analyst wants to identify the organization's subdomains and internal network structure without directly querying the target's DNS servers. Which OSINT source is most effective for this purpose?

   • AWHOIS database.
   • BSocial media profiles.
   • CSearch engine cached pages.
   • DCertificate transparency logs.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A red team operator is tasked with gaining initial access to a target organization. The operator has a limited budget and cannot afford commercial threat intelligence feeds. The operator needs to identify valid employee credentials or at least a list of potential usernames for a password spraying attack. The organization uses Microsoft 365 and has a standard email format of firstname.lastname@company.com. Which OSINT approach is most effective and cost-efficient?

   • APerform a DNS zone transfer to enumerate all user accounts in Active Directory.
   • BUse a search engine to find the company's internal directory listing all employees.
   • CUse LinkedIn and the company website to compile employee names, then generate usernames using the known email format.
   • DPurchase a database of breached credentials from the dark web.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is a key characteristic of passive reconnaissance?

   • AIt always involves sending network packets to the target
   • BIt requires prior access to the target's internal network
   • CIt does not directly interact with the target's systems
   • DIt is only used after active reconnaissance has been completed
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the final step in the footprinting process?

   • APerforming a vulnerability scan
   • BAnalyzing the collected information to identify potential attack vectors
   • CGaining unauthorized access to the target
   • DDeleting all traces of the footprinting activity
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which statement correctly distinguishes passive reconnaissance from active reconnaissance?

   • APassive reconnaissance does not directly interact with the target, while active reconnaissance does.
   • BPassive reconnaissance is always legal, while active reconnaissance is always illegal.
   • CPassive reconnaissance is used only for external targets, while active reconnaissance is used only for internal targets.
   • DPassive reconnaissance involves direct interaction with the target, while active reconnaissance does not.
   Reveal Solution Discussion Select an answer first