A penetration tester was hired to perform a penetration test for a bank. The tester began searching for IP ranges owned by the bank, performing lookups on the bank's DNS servers, reading news…

Information reporting is the final phase of a penetration test where findings are documented and delivered to the client, not an information collection phase.

Vulnerability assessment involves actively scanning and probing systems for known vulnerabilities, which requires direct technical interaction with target systems.

Active information gathering involves directly interacting with target systems (e.g., port scanning, banner grabbing), none of which the tester is performing here.

Passive information gathering (also called passive reconnaissance) involves collecting information about a target using publicly available sources and physical observation without directly engaging the target's systems. All activities described - DNS lookups, OSINT research, employee observation, job posting analysis, and dumpster diving - are non-intrusive and leave no footprint on the target's network or systems.