Certified Ethical Hacker Footprinting and Reconnaissance 2 — Questions and Answers
Question 1: What is Shodan primarily used for during the reconnaissance phase of ethical hacking?
- Searching social media profiles for target employees
- Finding internet-connected devices and their exposed services (Correct answer)
- Cracking WPA2 wireless passwords
- Performing automated SQL injection attacks
Correct answer: Finding internet-connected devices and their exposed services
Shodan is a search engine that indexes internet-connected devices, revealing open ports, running services, and banners useful for identifying exposed infrastructure.
Question 2: Which DNS record type maps a domain name to an IPv6 address?
- A record
- MX record
- AAAA record (Correct answer)
- CNAME record
Correct answer: AAAA record
The AAAA (quad-A) record maps a domain name to a 128-bit IPv6 address, while the A record maps to a 32-bit IPv4 address.
Question 3: What security risk does an improperly configured DNS zone transfer (AXFR) present to an organization?
- Allows remote code execution on the DNS server
- Exposes the entire DNS database including all internal hostnames to unauthorized parties (Correct answer)
- Enables man-in-the-middle attacks on all SSL connections
- Creates a denial-of-service vulnerability in the DNS infrastructure
Correct answer: Exposes the entire DNS database including all internal hostnames to unauthorized parties
An unrestricted DNS zone transfer exposes all DNS records for a domain, giving attackers a complete map of the internal network infrastructure and hostnames.
Question 4: What is the primary purpose of using Traceroute/Tracert during network footprinting?
- Crack passwords by tracing authentication packet sequences
- Map the network path and identify intermediate routers between attacker and target (Correct answer)
- Detect and identify malware running on the network
- Intercept and decrypt HTTPS web traffic
Correct answer: Map the network path and identify intermediate routers between attacker and target
Traceroute maps the route packets take to reach a destination, revealing intermediate routers, network topology, TTL values, and potential firewall or IDS locations.
Question 5: What type of sensitive organizational information can an attacker gather by analyzing a company's job postings?
- Employee passwords and hashed credentials
- Technology stack, software versions, and internal roles used by the organization (Correct answer)
- Direct credentials to access internal systems
- Physical security details such as access card systems
Correct answer: Technology stack, software versions, and internal roles used by the organization
Job postings commonly list required technologies, frameworks, and software versions that reveal the organization's technical environment and potential attack vectors.
Question 6: Which technique systematically queries a DNS server with a wordlist of possible names to enumerate subdomains of a target?
- Port scanning
- DNS brute-forcing (Correct answer)
- ARP poisoning
- Passive packet sniffing
Correct answer: DNS brute-forcing
DNS brute-forcing queries DNS servers with a large list of potential subdomain names to discover all valid subdomains associated with a target domain.
Question 7: What is banner grabbing used for during the reconnaissance phase of a penetration test?
- Capturing authentication tokens from active web sessions
- Identifying software names and versions running on open ports (Correct answer)
- Downloading entire website content for offline analysis
- Mapping all internal network subnets from a single host
Correct answer: Identifying software names and versions running on open ports
Banner grabbing captures the service banners returned when connecting to open ports, revealing the software type, version, and sometimes OS information.
Certified Ethical Hacker Footprinting and Reconnaissance 2
What is Shodan primarily used for during the reconnaissance phase of ethical hacking?