A penetration tester has been assigned to perform an external penetration assessment of a company. Which of the following steps would BEST help with the passive-information-gathering process?…

Tailgating an employee into a building is an active physical social engineering technique that requires in-person presence and direct interaction, not passive information gathering.

Running a vulnerability scan actively sends probe packets to the target's external netblock, which constitutes active reconnaissance and could alert the organization.

Domain and IP registry services such as WHOIS, ARIN, and RIPE provide publicly available registration records that reveal a company's external netblocks and IP ranges without sending any traffic to target systems, making this a purely passive OSINT technique.

Searching social media for IT employees who publicly share infrastructure details involves no direct interaction with target systems and relies entirely on open-source intelligence, which is the definition of passive reconnaissance.

Enumerating webmail user accounts and attempting access involves directly interacting with the target's systems and constitutes active exploitation activity, not passive gathering.