A penetration tester was hired to perform a penetration test for a bank. The tester began searching for IP ranges owned by the bank, performing lookups on the bank's DNS servers, reading news articles

Information reporting is the final phase where findings are documented and delivered, not an activity-based reconnaissance phase.

Vulnerability assessment involves actively scanning and testing systems for known weaknesses, which requires direct interaction with target systems.

Active information gathering involves directly probing or interacting with target systems (e.g., port scanning, banner grabbing), none of which is described here.

Passive information gathering involves collecting information about a target using indirect methods that do not touch or probe the target's systems directly. All activities described - OSINT via news and job postings, physical observation of employee schedules, DNS lookups via public records, and dumpster diving - are non-interactive reconnaissance techniques that leave no trace on the target's infrastructure.