312-50 Question 48
Single answer▪ Network FootprintingDuring an authorized external reconnaissance assessment, you need to identify the public-facing IP range and hosting provider used by a target company's web application without sending packets directly to the target infrastructure. Which approach is the most appropriate for this network footprinting objective?
- A
Query Regional Internet Registry (RIR) WHOIS records and use IP ownership lookups on the target domain's resolved public IP addresses
- B
Run a full TCP SYN scan against the target's entire /16 address space to identify active hosts and infer ownership
- C
Perform SNMP enumeration against the target's edge routers to retrieve interface and routing information
- D
Use SMB null sessions against internet-facing systems to enumerate shares and identify the hosting network
Show answer and explanation
Correct answer: A
Explanation
This question tests the ability to distinguish passive network footprinting from active enumeration. In CEH-style reconnaissance, passive methods are preferred when the rules of engagement require minimal interaction with the target. Resolving the organization's public domain and examining registration and routing metadata through WHOIS/RDAP and ASN-related data is a standard way to map public-facing infrastructure ownership. The five RIRs publish registration data for IP allocations, and RDAP has increasingly replaced legacy WHOIS for structured registration queries. This information can help determine whether the addresses belong directly to the organization, a cloud provider, or a CDN. By contrast, SYN scans, SNMP enumeration, and SMB null sessions all involve direct probing and move beyond passive footprinting into active reconnaissance.
- A. Correct.
Correct. For passive network footprinting, resolving the target domain to its public IP and checking WHOIS/RDAP or other IP ownership data from the relevant RIRs (such as ARIN, RIPE NCC, APNIC, LACNIC, or AFRINIC) is an appropriate method. This can reveal the netblock owner, ASN, and often the hosting provider or CDN. It aligns with the scenario requirement to avoid sending packets directly to the target infrastructure.
- B. Incorrect.
Incorrect. A full TCP SYN scan is active reconnaissance, not passive footprinting. It sends packets directly to target systems and would violate the stated constraint. Although scanning can identify live hosts, it is not the most appropriate approach when the objective is specifically to avoid direct interaction with the target.
- C. Incorrect.
Incorrect. SNMP enumeration is also an active technique and requires reachable SNMP services plus valid community strings or credentials. In an external footprinting phase, this is both intrusive and unlikely to succeed without prior access. It does not fit the requirement for non-intrusive identification of public IP ownership.
- D. Incorrect.
Incorrect. SMB null sessions are used for Windows enumeration on systems exposing SMB services, typically internally or on poorly secured hosts. This is an active enumeration method, not passive footprinting, and it would not be the preferred way to identify public IP ranges or a hosting provider from the outside.