nerdexam
GIAC

GPEN · Question #6

Which of the following is NOT an example of passive footprinting?

The correct answer is A. Scanning ports.. Port scanning is active footprinting because it directly probes target systems, whereas passive footprinting collects information from public sources without touching the target.

Penetration Testing Foundations & Reconnaissance

Question

Which of the following is NOT an example of passive footprinting?

Options

  • AScanning ports.
  • BAnalyzing job requirements.
  • CPerforming the whois query.
  • DQuerying the search engine.

How the community answered

(45 responses)
  • A
    78% (35)
  • B
    4% (2)
  • C
    7% (3)
  • D
    11% (5)

Why each option

Port scanning is active footprinting because it directly probes target systems, whereas passive footprinting collects information from public sources without touching the target.

AScanning ports.Correct

Scanning ports requires sending probe packets directly to the target host to determine which services are listening, which constitutes active reconnaissance. This direct interaction with the target distinguishes it from passive techniques, where the attacker gathers publicly available data without ever contacting or alerting the target system.

BAnalyzing job requirements.

Analyzing job requirements is passive footprinting because it involves reviewing publicly posted information such as job listings to infer the target organization's technology stack and infrastructure without any direct contact.

CPerforming the whois query.

Performing a whois query is passive footprinting because it retrieves publicly registered domain, IP block, and registrant information from third-party registries without probing the target directly.

DQuerying the search engine.

Querying a search engine is passive footprinting because it leverages publicly indexed data to gather information about a target without establishing any direct connection to the target's systems.

Concept tested: Active vs. passive footprinting reconnaissance distinction

Source: https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/01-Conduct_Search_Engine_Discovery_Reconnaissance_for_Information_Leakage

Topics

#passive footprinting#active reconnaissance#OSINT#port scanning

Community Discussion

No community discussion yet for this question.

Full GPEN Practice