312-50 Question 47
Single answer▪ Network FootprintingDuring an authorized external reconnaissance engagement, you need to identify the public-facing IP ranges and internet-exposed services that belong to a target company before any active scanning is approved. The client has only provided the company name and primary domain. Which approach is the MOST appropriate first step in network footprinting to gather this information while minimizing direct interaction with the target's infrastructure?
- A
Perform WHOIS lookups on the target domain and query regional internet registry databases to identify registered netblocks and ownership details
- B
Run a full TCP SYN scan against the target's domain and all discovered subdomains to enumerate open ports
- C
Launch a DNS zone transfer request against the target's authoritative name servers to retrieve all host records
- D
Send crafted ICMP and TCP probes to suspected address ranges to map live hosts before identifying ownership
Show answer and explanation
Correct answer: A
Explanation
In CEH-style reconnaissance, network footprinting typically begins with passive information gathering to identify a target organization's registered internet resources before moving to active enumeration. WHOIS records and RIR databases are foundational sources for discovering public netblocks, ASN details, and ownership information tied to a company or domain. After candidate ranges are identified and authorization permits, the tester can proceed with DNS interrogation, host discovery, and port/service enumeration. This sequence aligns with common reconnaissance best practices: start passive, validate scope, then move to active techniques. Relevant public references include ICANN WHOIS/RDAP services and the regional internet registries such as ARIN and RIPE NCC, which document allocation and registration data used during footprinting.
- A. Correct.
Correct. WHOIS and regional internet registry (RIR) sources such as ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC are standard passive footprinting resources for identifying registered IP ranges, autonomous system information, and ownership/contact details associated with a company. This is an appropriate first step because it helps define the scope of public assets with minimal or no direct interaction with the target's systems.
- B. Incorrect.
Incorrect. A TCP SYN scan is an active reconnaissance technique, not an initial passive footprinting step. It directly interacts with target systems and may generate logs or alerts. The scenario specifically states that active scanning has not yet been approved, so this would be premature even though it is useful later for service enumeration.
- C. Incorrect.
Incorrect. Attempting a DNS zone transfer is an active technique against the target's DNS infrastructure. While misconfigured zone transfers can reveal many hosts, it is not the most appropriate first step when the goal is to minimize direct interaction. It also assumes the target permits AXFR, which most properly configured authoritative DNS servers do not.
- D. Incorrect.
Incorrect. ICMP and TCP probing are active host discovery methods. They can help map live systems after candidate ranges are known, but they are not suitable as the first step when ownership of address space has not yet been established and the engagement has not approved active scanning.