Reconnaissance, Footprinting, and OSINT Techniques EHE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the first step in the footprinting process?

   • AScanning the target's network for open ports
   • BCollecting publicly available information about the target
   • CReporting findings to the client
   • DExploiting identified vulnerabilities
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Why is footprinting considered a critical step in the ethical hacking methodology?

   • AIt automatically identifies all vulnerabilities in the target's systems
   • BIt ensures that the target's systems will not be damaged during testing
   • CIt helps the ethical hacker understand the target's security posture and potential attack surface
   • DIt provides legal authorization for the ethical hacking engagement
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security consultant is starting an external penetration test for a client. The consultant wants to understand the client's network topology, including the IP address ranges, domain names, and the technologies in use, without sending any packets to the client's systems. Which activity best fits this requirement?

   • ASend a probe packet to the client's mail server to see if it responds.
   • BPerform a network scan using Nmap to map open ports and services.
   • CUse the client's website, DNS records, and WHOIS data to infer network ranges and technologies.
   • DCall the client's IT help desk and ask about their firewall configuration.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A penetration tester is planning a security assessment. The tester wants to gather initial information about the target without being detected, but later plans to actively scan the target. Which sequence of actions best aligns with the ethical hacking methodology?

   • ASkip passive reconnaissance and go directly to exploitation.
   • BUse only active reconnaissance to save time.
   • CPerform active reconnaissance first, then passive reconnaissance.
   • DPerform passive reconnaissance first, then active reconnaissance.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A penetration tester is conducting active reconnaissance on a target network. The tester has already performed a ping sweep and identified several live hosts. The tester now needs to identify which hosts are running web servers and which are running database services. The tester wants to minimize the number of packets sent to avoid detection. Which technique is most appropriate?

   • APerform a targeted port scan on common web and database ports (e.g., 80, 443, 3306, 1433) on the live hosts.
   • BPerform a full port scan on all 65,535 ports of each live host.
   • CUse a vulnerability scanner to check for known vulnerabilities on all live hosts.
   • DQuery the DNS server for service records (SRV) to identify web and database services.
   Reveal Solution Discussion Select an answer first