Reconnaissance, Footprinting, and OSINT Techniques EHE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst is performing reconnaissance on a target organization. The analyst has already gathered employee names and email addresses from LinkedIn and the company website. The next step is to identify the organization's public IP address range and the hosting provider. Which combination of techniques would most efficiently achieve this goal?

   • AUse a port scanner to scan all 65,535 ports on the company's main website IP.
   • BSend a phishing email to employees to trick them into revealing the internal IP scheme.
   • CPerform a WHOIS lookup on the domain and query DNS for MX and NS records.
   • DSearch the company's annual report for its physical office addresses.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security consultant is performing footprinting on a client organization. The consultant has collected the following information: the organization's domain name, the IP addresses of its public web and mail servers, and the names of key employees from LinkedIn. The consultant now needs to determine the organization's network topology, including the internal IP address scheme and the location of firewalls. Which technique is most likely to reveal this information?

   • ASearch public code repositories and forums for configuration files or network diagrams that employees may have accidentally posted.
   • BSend a traceroute to the public web server to map the internal network.
   • CUse a WHOIS lookup on the domain to find the internal network range.
   • DPerform a port scan of the public web server to identify internal IP addresses in the response headers.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is footprinting in the context of ethical hacking?

   • AThe process of removing evidence of an attack from target logs
   • BThe process of identifying vulnerabilities in a target's applications
   • CThe process of gathering information about a target system or network to create a profile
   • DThe process of exploiting weaknesses to gain access to a target
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst is building a profile of a target organization using OSINT. The analyst has collected data from social media, job postings, and public financial reports. The analyst notices that the organization uses a specific ERP system and has recently posted job openings for administrators of that system. How should the analyst apply this information?

   • AReport the findings to the client without further analysis.
   • BContact the organization's HR department to confirm the ERP system version.
   • CIgnore the job postings because they are not directly related to the network infrastructure.
   • DUse the ERP system name and version to search for known vulnerabilities and potential attack vectors.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security analyst is performing reconnaissance on a target organization that uses a third-party cloud provider for its public website. The analyst has already identified the cloud provider and the website's IP address. The analyst now needs to determine if the organization has any other public-facing services hosted on the same cloud account. Which technique is most effective for this task?

   • APerform a port scan of the website's IP address to find other services.
   • BQuery the cloud provider's API for a list of all customer resources.
   • CUse a WHOIS lookup on the website's IP address to find the cloud account owner.
   • DSearch for the organization's domain and related domains in public certificate transparency logs.
   Reveal Solution Discussion Select an answer first