312-50 Question 23
Single answer▪ Footprinting MethodologyA security consultant is performing the reconnaissance phase of an authorized assessment against a company that wants to minimize the chance of detection and avoid direct interaction with its production systems until later phases. The consultant has already identified the company's primary domain name and now needs to expand the organization's external attack surface by finding additional internet-facing assets such as subdomains, related IP ranges, and third-party hosted services. Which approach is the MOST appropriate next step in a footprinting methodology?
- A
Use passive OSINT techniques such as WHOIS, public DNS records, certificate transparency logs, search engines, and internet intelligence platforms to enumerate domains, subdomains, and ownership information before active scanning
- B
Launch a full-range TCP SYN scan and service enumeration against the target's public IP space to quickly identify exposed hosts and gather banner information
- C
Send crafted phishing emails to employees to collect internal naming conventions and VPN portal details from responses
- D
Run a vulnerability scanner against suspected cloud-hosted assets to confirm software versions and identify exploitable weaknesses
Show answer and explanation
Correct answer: A
Explanation
The best answer is the passive OSINT approach because footprinting begins with collecting as much information as possible from publicly available sources before interacting directly with the target. In real-world CEH-style methodology, passive reconnaissance commonly includes WHOIS and registrar data, DNS record analysis, search engine discovery, certificate transparency logs, BGP/ASN intelligence, and public breach or infrastructure indexing sources. These methods help map an organization's external presence while minimizing the likelihood of detection. This sequence is consistent with common ethical hacking and penetration testing best practices: perform passive reconnaissance first, validate scope and ownership, then move into active scanning and enumeration only when appropriate. Public resources such as ICANN WHOIS/RDAP services, DNS documentation, and certificate transparency ecosystems support these passive discovery techniques.
- A. Correct.
Correct. In a footprinting methodology, especially when the client wants to reduce detectability and avoid touching production systems early, passive reconnaissance is the preferred next step. WHOIS can reveal registration and ownership details, public DNS records can expose hostnames and mail infrastructure, certificate transparency logs often reveal subdomains, and search engines or internet intelligence sources can identify exposed assets without direct probing of the target. This aligns with standard CEH-style reconnaissance practice: start broad with passive information gathering before moving to active enumeration.
- B. Incorrect.
Incorrect. A TCP SYN scan is an active technique. While useful later during scanning and enumeration, it directly interacts with target systems and can trigger IDS/IPS, firewall logs, or rate-limiting controls. The scenario explicitly states the consultant should minimize the chance of detection and avoid direct interaction during this stage, so active port scanning is not the most appropriate next step in footprinting.
- C. Incorrect.
Incorrect. Phishing employees is a social engineering attack technique, not an appropriate next step in standard footprinting methodology for expanding the external attack surface. It also introduces legal, ethical, and operational risk unless explicitly scoped. Even in authorized engagements, phishing is typically a separate workstream and not the preferred method when passive external reconnaissance can provide the needed information.
- D. Incorrect.
Incorrect. Vulnerability scanning is a much later-stage active assessment activity. It does not fit the stated goal of low-detection footprinting and requires direct interaction with hosts. In addition, scanning suspected cloud assets before confirming ownership can produce inaccurate scope assumptions and unnecessary noise.