100-160 Question 182
Select 3A cybersecurity analyst is tasked with identifying vulnerabilities in a company’s network without disrupting operations. They decide to use passive reconnaissance methods before conducting active scans. Which of the following techniques would be considered passive reconnaissance?
- A
Analyzing DNS records to gather information about the organization's domain
- B
Using a port scanning tool to identify open ports on a server
- C
Monitoring publicly available social media profiles for sensitive information leakage
- D
Intercepting network traffic using a packet sniffer without sending any packets
- E
Running an automated vulnerability scanner on the organization's internal systems
Show answer and explanation
Correct answers: A, C, D
Explanation
Passive reconnaissance involves gathering information about a target without directly interacting with it or causing any detectable activity on the network. Techniques like analyzing DNS records, monitoring social media profiles, and passively intercepting network traffic fit this description. In contrast, active reconnaissance methods such as port scanning or running vulnerability scanners involve direct interaction with the target and may leave traces.
- A. Correct.
Analyzing DNS records is a passive reconnaissance method because it involves gathering publicly available information without directly interacting with the target systems.
- B. Incorrect.
Using a port scanning tool is an active reconnaissance method since it involves interacting with the target system to identify open ports, potentially causing detectable network activity.
- C. Correct.
Monitoring publicly available social media profiles is a form of passive reconnaissance as it involves collecting information without direct interaction or causing network activity.
- D. Correct.
Intercepting network traffic using a packet sniffer without sending packets is passive reconnaissance since it observes network data without interfering with the communication flow.
- E. Incorrect.
Running an automated vulnerability scanner is an active method because it interacts with the target systems to identify vulnerabilities, potentially causing detectable network activity.