At the beginning of a penetration test, the tester finds a file that includes employee data, such as email addresses, work phone numbers, computers names, and office locations. The file is hosted on…

Enumeration of services involves actively querying running services (such as LDAP, SNMP, or SMB) to extract resource lists and is an active technique, not the passive discovery of an already-public file.

Open Source Intelligence (OSINT) refers to the collection and analysis of information obtained from publicly available sources without active probing or intrusion. Discovering an employee data file hosted on a public web server requires no authentication bypass or exploitation - the data is already public - which precisely matches the definition of passive OSINT reconnaissance used in the pre-engagement information-gathering phase.

Port scanning actively probes a host's TCP/UDP ports to identify open services and does not describe the act of finding and reading a data file on a publicly accessible web server.

Social engineering involves manipulating people through deception or psychological pressure to disclose information, which is not relevant to finding a file that is already publicly hosted.