Which of the following penetration testing phases involves gathering data from whois, DNS, and network scanning, which helps in mapping a target network and provides valuable information regarding…

The post-attack phase occurs after exploitation and focuses on activities like covering tracks, removing artifacts, and restoring systems to avoid detection - not initial data gathering.

On-attack phase is not a recognized standard term in penetration testing methodology; active exploitation belongs to the attack phase, not a reconnaissance-oriented phase.

The attack phase involves actively exploiting vulnerabilities using intelligence already gathered in earlier phases, not performing initial reconnaissance through whois or DNS queries.

The pre-attack phase, also called footprinting or reconnaissance, is specifically dedicated to passively and actively gathering intelligence about a target before any attack is launched. Techniques include querying whois databases, performing DNS lookups, and running network scans to identify live hosts, open ports, operating systems, and running applications. All of this data collection occurs prior to exploitation and informs the attacker's strategy for later phases.