Reconnaissance, Footprinting, and OSINT Techniques EHE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A threat intelligence analyst is tasked with assessing the risk of a targeted phishing campaign against a specific company. The analyst has collected the following OSINT: employee names and job titles from LinkedIn, the company's email format (firstname.lastname@company.com), and the technologies listed in job postings (e.g., Microsoft 365, Salesforce). Which analysis best applies this OSINT to identify potential attack vectors?

   • AThe email format and employee names enable the creation of convincing spear-phishing emails targeting specific individuals.
   • BThe technology list indicates that the company is vulnerable to all known exploits for those technologies.
   • CThe LinkedIn data proves that the company has weak password policies.
   • DThe OSINT collected is sufficient to directly exploit the company's network without further reconnaissance.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security analyst is performing OSINT on a target organization. The analyst has found that the organization's employees use a common password pattern (e.g., Season+Year) and that the organization recently suffered a data breach that exposed hashed passwords. The analyst also found a public GitHub repository where a developer accidentally committed a file containing internal API keys. Which OSINT finding is most directly actionable for gaining unauthorized access?

   • AThe employee names and email addresses from LinkedIn.
   • BThe fact that the organization uses a common cloud provider.
   • CThe exposed API keys in the public GitHub repository.
   • DThe password pattern and breached hashes.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An OSINT analyst is building a profile of a target organization for a red team exercise. The analyst has found the organization's domain registration details, employee email addresses, and a list of technologies mentioned in job postings. The analyst now needs to find any publicly exposed documents that might contain metadata such as usernames or internal paths. Which OSINT technique is most appropriate for this task?

   • AUse a WHOIS lookup to find the domain registrar's contact information.
   • BPerform a port scan of the target's web server to identify services that might host documents.
   • CUse a search engine with operators like 'site:example.com filetype:pdf' to find documents and then analyze their metadata.
   • DSend a crafted email to the target's HR department asking for internal documents.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security analyst is footprinting a target organization. The analyst wants to gather information about the organization's network infrastructure, including DNS servers and mail servers, without directly querying the target's systems. Which OSINT tool or source is most appropriate?

   • ASend a DNS zone transfer request to the target's DNS server.
   • BUse a public DNS lookup service to query the target's DNS records.
   • CUse a network scanning tool to enumerate open ports on the target's mail server.
   • DPerform a ping sweep on the target's IP range.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is a common risk associated with active reconnaissance?

   • AIt may trigger intrusion detection systems and alert the target
   • BIt always causes damage to the target's systems
   • CIt provides less accurate information than passive reconnaissance
   • DIt is illegal in all jurisdictions
   Reveal Solution Discussion Select an answer first