312-50 Question 51
Single answer▪ Footprinting through Social EngineeringDuring an authorized CEH reconnaissance engagement, you are tasked with gathering information about a target company's internal help-desk process without directly attacking any systems. The rules of engagement allow phone-based social engineering but prohibit requesting passwords, installing software, or causing disruption. Which approach would be the MOST appropriate for footprinting through social engineering while staying within scope and maximizing useful information?
- A
Call the help desk while posing as a new remote employee and ask what identity verification steps, ticketing details, and VPN enrollment process are required before account support is provided.
- B
Call the help desk pretending to be the CIO and pressure the technician to reset an executive account immediately so you can verify whether privilege escalation controls are weak.
- C
Send a phishing email to several employees asking them to log in to a cloned portal so you can identify naming conventions and MFA prompts.
- D
Contact the network operations team and ask them to run a vulnerability scan for you, claiming you are an approved third-party auditor.
Show answer and explanation
Correct answer: A
Explanation
Footprinting through social engineering focuses on collecting useful organizational intelligence from people without necessarily compromising accounts or systems. In this scenario, the best answer is the one that uses a believable pretext to learn support procedures, identity checks, and onboarding workflows while avoiding requests for passwords, software installation, or operational changes. That makes Option 1 the most appropriate choice. CEH exam objectives commonly distinguish reconnaissance and footprinting from more intrusive attack phases such as phishing for credentials, eliciting account resets, or inducing system changes. From a best-practice perspective, authorized social engineering assessments should remain tightly aligned to the rules of engagement, minimize impact, and avoid actions that could alter production systems or lead to unauthorized access.
- A. Correct.
Correct. This approach gathers process-oriented intelligence through pretexting without requesting credentials, malware execution, or unauthorized access. It is aligned with a footprinting objective because it reveals how the organization verifies identity, handles support requests, and onboards remote users. Those details can help map defensive procedures and identify potential human-process weaknesses while remaining within the stated rules of engagement.
- B. Incorrect.
Incorrect. Although this is a form of social engineering, it goes beyond passive or low-impact footprinting. Requesting an executive account reset attempts to trigger an account action and tests operational controls in a way that could cause disruption or unauthorized change. It also crosses the stated boundary by attempting to manipulate a privileged support workflow rather than just gathering information.
- C. Incorrect.
Incorrect. A phishing campaign with a cloned portal is an active credential-harvesting technique, not simple footprinting. It would violate the scope because it attempts to collect logon data and likely involves unauthorized interaction with authentication systems. In CEH terms, this moves from reconnaissance into active social engineering attack execution.
- D. Incorrect.
Incorrect. This option is not a proper footprinting-through-social-engineering technique for the stated objective. It asks internal staff to perform a security operation based on a false claim, which could create disruption and falls outside passive information gathering. It also does not directly focus on understanding help-desk processes.