SY0-701 Question 473
Single answerReconnaissance: Passive , ActiveA security analyst is gathering information about a third-party company's internet-facing environment before a formal penetration test begins. The contract states that the analyst must not transmit any packets to the target's systems during this phase, but management still wants useful intelligence about exposed technologies, email formats, and public infrastructure. Which reconnaissance approach should the analyst use FIRST to stay within scope and meet the requirement?
- A
Use passive reconnaissance by reviewing public records, DNS information from third-party sources, search engines, social media, and certificate transparency logs
- B
Run a TCP SYN scan against the target's public IP ranges during off-hours to reduce the chance of detection
- C
Perform banner grabbing against the company's web and mail servers to identify software versions without authenticating
- D
Launch a vulnerability scan with safe-check settings enabled so the target experiences minimal impact
Show answer and explanation
Correct answer: A
Explanation
The key distinction is whether the analyst directly interacts with the target's systems. Passive reconnaissance collects information from publicly available or third-party sources without sending traffic to the target. Active reconnaissance involves direct engagement, such as scanning, enumeration, service interrogation, or vulnerability assessment. In real-world engagements, scope and rules of engagement determine what is permitted at each stage, and violating those restrictions can create legal and contractual issues. Industry best practice is to begin with passive collection when direct probing is prohibited, then move to active techniques only after authorization. This aligns with common penetration testing rules of engagement and reconnaissance guidance reflected in security assessment methodologies and practice standards such as NIST SP 800-115, which distinguishes planning, rules of engagement, and technical discovery activities.
- A. Correct.
Correct. Passive reconnaissance gathers information without directly interacting with the target's systems. In this scenario, the contract explicitly prohibits sending packets to the target during this phase, so using search engines, public websites, social media, WHOIS/RDAP records, certificate transparency logs, breach data, and DNS information collected from third-party repositories is the appropriate first step. This approach can reveal technologies in use, naming conventions, employee details, exposed subdomains, and email address patterns while remaining within scope.
- B. Incorrect.
Incorrect. A TCP SYN scan is active reconnaissance because it sends packets directly to the target to identify live hosts and open ports. Even if performed during off-hours or with rate limiting, it still violates the stated restriction against transmitting packets to the target's systems. A common misconception is that low-noise scanning becomes passive, but any direct probing of the target is active.
- C. Incorrect.
Incorrect. Banner grabbing is also active reconnaissance because it directly connects to target services and requests or captures service responses. Although it is often used early in an assessment to identify versions and exposed services, it is not allowed here because it requires direct interaction with the target environment. Candidates may choose this because it seems less intrusive than a scan, but it still generates traffic to the target.
- D. Incorrect.
Incorrect. A vulnerability scan, even with conservative or safe-check settings, is active reconnaissance or active assessment because it probes the target directly. Safe settings may reduce operational risk, but they do not make the activity passive. This option reflects a common misunderstanding that reduced impact changes the classification of the activity.