A penetration tester was hired to perform a penetration test for a bank. The tester began searching for IP ranges owned by the bank, performing lookups on the bank's DNS servers, reading news articles

Information reporting is the final phase where findings are documented and delivered to the client, not an intelligence-collection phase.

Vulnerability assessment involves actively scanning or testing systems for known weaknesses, which has not yet begun in this scenario.

Active information gathering involves directly interacting with target systems (such as port scanning or banner grabbing), none of which is described here.

Passive information gathering (passive reconnaissance) involves collecting intelligence about a target using sources that do not require direct interaction with the target's live infrastructure, such as WHOIS lookups, public DNS records, news articles, job postings, physical observation, and dumpster diving. None of the activities described involve sending packets to or actively probing the bank's systems, which is the key distinction from active information gathering.