Certified Ethical Hacker Footprinting and Reconnaissance 2

Question 1

What is Shodan primarily used for during the reconnaissance phase of ethical hacking?

Accepted Answer

Finding internet-connected devices and their exposed services

Answer

Searching social media profiles for target employees

Answer

Cracking WPA2 wireless passwords

Answer

Performing automated SQL injection attacks

Question 2

Which DNS record type maps a domain name to an IPv6 address?

Accepted Answer

AAAA record

Answer

A record

Answer

MX record

Answer

CNAME record

Question 3

What security risk does an improperly configured DNS zone transfer (AXFR) present to an organization?

Accepted Answer

Exposes the entire DNS database including all internal hostnames to unauthorized parties

Answer

Allows remote code execution on the DNS server

Answer

Enables man-in-the-middle attacks on all SSL connections

Answer

Creates a denial-of-service vulnerability in the DNS infrastructure

Question 4

What is the primary purpose of using Traceroute/Tracert during network footprinting?

Accepted Answer

Map the network path and identify intermediate routers between attacker and target

Answer

Crack passwords by tracing authentication packet sequences

Answer

Detect and identify malware running on the network

Answer

Intercept and decrypt HTTPS web traffic

Question 5

What type of sensitive organizational information can an attacker gather by analyzing a company's job postings?

Accepted Answer

Technology stack, software versions, and internal roles used by the organization

Answer

Employee passwords and hashed credentials

Answer

Direct credentials to access internal systems

Answer

Physical security details such as access card systems

Question 6

Which technique systematically queries a DNS server with a wordlist of possible names to enumerate subdomains of a target?

Accepted Answer

DNS brute-forcing

Answer

Port scanning

Answer

ARP poisoning

Answer

Passive packet sniffing

Question 7

What is banner grabbing used for during the reconnaissance phase of a penetration test?

Accepted Answer

Identifying software names and versions running on open ports

Answer

Capturing authentication tokens from active web sessions

Answer

Downloading entire website content for offline analysis

Answer

Mapping all internal network subnets from a single host