312-50 Question 24
Select 3▪ Footprinting MethodologyDuring a sanctioned pre-engagement for a financial services company, an ethical hacker is instructed to begin with passive footprinting only and avoid sending traffic directly to the target's infrastructure. The goal is to identify internet-facing assets and likely administrative contacts for examplebank.com before active scanning is approved. Which TWO actions best align with this requirement?
- A
Query public WHOIS and registrar records for examplebank.com to identify registration details, name servers, and contact information
- B
Perform a DNS zone transfer (AXFR) against the target's authoritative name servers to enumerate subdomains
- C
Review certificate transparency logs and search engine results to identify subdomains and exposed hostnames related to examplebank.com
- D
Run an Nmap SYN scan against the target's public IP ranges to discover live hosts and open ports
- E
Use public BGP and ASN databases to map IP address ranges that are publicly associated with the organization
Show answer and explanation
Correct answers: A, C, E
Explanation
This scenario tests whether the candidate can distinguish passive footprinting from active enumeration in a real engagement. In CEH methodology, footprinting is the information-gathering phase used to collect data about a target's domains, contacts, IP space, and exposed assets. Passive techniques rely on third-party or publicly available data sources and avoid direct interaction with the target. In this case, WHOIS/registrar data, certificate transparency logs, search engine results, and public BGP/ASN databases are appropriate because they can reveal domain ownership, likely contacts, subdomains, and IP ranges while honoring the passive-only constraint. By contrast, DNS zone transfer attempts and Nmap scans involve direct communication with the target's infrastructure and fall under active reconnaissance or enumeration. This aligns with common security assessment practice and public references such as ICANN WHOIS/RDAP services, Certificate Transparency ecosystems, and public routing registries or ASN data sources used in reconnaissance.
- A. Correct.
Correct. WHOIS and registrar records are classic passive footprinting sources. They can reveal domain registration metadata, registrar information, name servers, and sometimes administrative or technical contact details without directly interacting with the target's systems. This fits the requirement to identify likely contacts and infrastructure-related information during the initial footprinting phase.
- B. Incorrect.
Incorrect. A DNS zone transfer attempt is an active interaction with the target's authoritative DNS server. Even if misconfiguration could expose valuable records, sending an AXFR request directly to the target violates the stated passive-only constraint. Candidates often choose this because zone transfers are part of enumeration, but they are not passive footprinting.
- C. Correct.
Correct. Certificate Transparency logs and search engine indexing are valuable passive sources for discovering subdomains, hostnames, and services associated with a domain. Reviewing publicly available CT data does not require direct contact with the target and is commonly used during early footprinting to build an external asset inventory.
- D. Incorrect.
Incorrect. An Nmap SYN scan is active reconnaissance because it sends packets directly to the target's IP addresses to determine host availability and open ports. While useful later in an engagement, it does not comply with the passive-only restriction in this scenario.
- E. Correct.
Correct. Public BGP and ASN information can help map internet-facing IP ranges associated with an organization without probing the target directly. This is a practical passive footprinting technique for identifying the organization's network presence and scoping likely public assets before active testing begins.