SY0-701 Question 474
Single answerReconnaissance: Passive , ActiveA security analyst is gathering information about a newly acquired subsidiary before a formal penetration test begins. Management has instructed the analyst to avoid any activity that could touch the subsidiary's systems or generate detectable traffic to its network. Which action would BEST meet this requirement while still supporting reconnaissance efforts?
- A
Query the subsidiary's public web server with a vulnerability scanner to identify exposed services
- B
Perform a zone transfer request against the subsidiary's authoritative DNS server
- C
Review the company's public website, job postings, and WHOIS records to identify technologies and external contacts
- D
Run an Nmap SYN scan against the subsidiary's public IP range during off-hours to reduce detection risk
Show answer and explanation
Correct answer: C
Explanation
The key distinction is that passive reconnaissance collects information without directly interacting with the target's systems, while active reconnaissance sends traffic or requests to the target environment. In this scenario, management explicitly prohibited activities that could touch the subsidiary's systems or create detectable network traffic, so passive methods are required. Reviewing public sources such as websites, WHOIS records, public filings, job advertisements, and social media is the best fit. By contrast, vulnerability scans, DNS zone transfer attempts, and Nmap scans all involve direct interaction and are considered active reconnaissance. This distinction is consistent with common security assessment methodology and industry guidance, including reconnaissance practices described in penetration testing frameworks and defensive monitoring guidance from organizations such as NIST, where scanning and direct enumeration are treated as detectable, interactive actions.
- A. Incorrect.
This is incorrect because using a vulnerability scanner directly interacts with the target's systems and generates network traffic that can be logged or detected. That makes it active reconnaissance, not passive reconnaissance. A candidate might choose this because vulnerability scanning is commonly used early in assessments, but it does not satisfy the requirement to avoid touching the target environment.
- B. Incorrect.
This is incorrect because attempting a DNS zone transfer is an active query against the target's DNS infrastructure. While zone transfers can reveal valuable reconnaissance data if misconfigured, the request still reaches the target system and may be logged. The misconception here is that DNS-related activity is automatically passive; in reality, direct DNS interrogation of the target is active reconnaissance.
- C. Correct.
This is correct because reviewing publicly available information such as the organization's website, job postings, press releases, social media presence, certificate transparency data, and WHOIS records is passive reconnaissance. These sources can reveal technologies in use, business relationships, naming conventions, and personnel details without sending traffic to the target's systems. This aligns with the requirement to avoid detectable interaction with the subsidiary's network.
- D. Incorrect.
This is incorrect because an Nmap SYN scan is a classic example of active reconnaissance. Even though a SYN scan may be more stealthy than a full-connect scan and running it during off-hours may reduce attention, it still sends packets to the target network and can trigger alerts in firewalls, IDS, IPS, or SIEM platforms. The trap here is confusing 'stealthier' active scanning with passive reconnaissance.