A penetration tester is evaluating a company's network perimeter. The tester has received limited information about defensive controls or countermeasures, and limited internal knowledge of the…

Launching an external scan of netblocks is an active reconnaissance technique and is typically performed after identifying the target IP ranges and specific hosts, not as the very first planning step.

While checking WHOIS and netblock records is a crucial passive step to identify domain ownership and IP ranges, DNS lookups (C) are more direct in determining the specific external hosts that are actively configured and exposed.

Using DNS lookups and tools like `dig` is a fundamental passive reconnaissance step to identify publicly advertised hostnames and their corresponding IP addresses. This directly determines the external hosts that form the company's network perimeter before any active engagement.

Conducting a ping sweep is an active reconnaissance method used to discover live hosts within a specified IP range, which is more intrusive and typically performed after initial passive identification of target networks.