312-50 Question 46
Select 2▪ Network FootprintingDuring an authorized external reconnaissance engagement, you are asked to identify the public-facing IP ranges and mail infrastructure used by a target company without sending packets directly to its hosts. You already know the company’s primary domain name. Which TWO actions are the most appropriate for this network footprinting task?
- A
Query the target domain’s WHOIS and Regional Internet Registry (RIR) records to identify registered netblocks and ownership details
- B
Perform a TCP SYN scan against the target’s web servers to infer the organization’s address ranges from live responses
- C
Retrieve DNS records such as MX, NS, and A/AAAA records for the target domain using public DNS lookups
- D
Use an SNMP walk against the target’s edge routers to enumerate interfaces and routing information
- E
Launch a UDP port scan against the target’s mail servers to confirm which hosts belong to the company
Show answer and explanation
Correct answers: A, C
Explanation
This question tests the ability to distinguish passive network footprinting from active scanning during reconnaissance. In CEH contexts, footprinting often begins with publicly available data sources before any direct interaction with target systems. WHOIS and RIR databases, such as ARIN, RIPE, APNIC, LACNIC, and AFRINIC, can reveal organization names, netblocks, and related registration details. Public DNS queries can identify mail exchangers, authoritative name servers, and public host records associated with the target domain. By contrast, SYN scans, UDP scans, and SNMP walks are active techniques because they transmit packets to the target’s infrastructure. Best practice in reconnaissance is to use passive methods first to reduce noise, avoid detection, and build an accurate map of the target’s external presence before moving into active validation if the rules of engagement allow it.
- A. Correct.
Correct. WHOIS and RIR data are standard passive footprinting sources for identifying organization ownership, autonomous system information, and publicly registered IP ranges. In a CEH-style reconnaissance scenario where direct interaction with target hosts is restricted, these records are one of the best ways to map public-facing network allocations.
- B. Incorrect.
Incorrect. A TCP SYN scan is an active reconnaissance technique because it sends packets directly to the target systems. Although it may help identify live hosts and services, it does not satisfy the requirement to avoid direct contact with the target’s hosts.
- C. Correct.
Correct. Public DNS lookups for MX, NS, and A/AAAA records are a core network footprinting technique. MX records help identify mail infrastructure, NS records reveal authoritative name servers, and address records can expose public-facing hosts tied to the domain, all without directly probing the target hosts in the same way as active scanning.
- D. Incorrect.
Incorrect. An SNMP walk is an active enumeration method and also depends on SNMP being exposed and accessible, which is uncommon on well-secured Internet-facing routers. It would violate the constraint against sending packets directly to the target’s infrastructure.
- E. Incorrect.
Incorrect. A UDP port scan is also an active technique and directly probes target systems. While it can reveal services, it is not appropriate when the goal is passive network footprinting based on publicly available information.