Original, concept-based questions written to teach the testable ideas — not exam dumps (those violate the EC-Council Candidate Agreement and get certs revoked). Answers are collapsed: think first, then expand. Aim for ≥80% before moving on. Log misses in PROGRESS.md.
Pairs with facts.md · flashcards.csv · README.md.
Q1. An analyst runs a WHOIS lookup and browses Google's cache: of the target's site, but sends no traffic to the target's own servers. How is this classified?
- A. Active footprinting
- B. Passive footprinting
- C. Scanning
- D. Enumeration
Answer
**B. Passive footprinting.** No packet reaches the target's infrastructure — WHOIS queries a registry and `cache:` returns Google's stored copy. The dividing line the exam tests: *did a packet touch the target's own systems?* If not, it's passive. **Tell:** WHOIS, Google, Shodan, and cached pages are always passive.
Q2. Which activity is active footprinting?
- A. Querying a public WHOIS server
- B. Searching Shodan for the target's exposed services
- C. Requesting a DNS zone transfer from the target's name server
- D. Reading the target's LinkedIn page
Answer
**C. Zone transfer (AXFR).** You are asking the target's *own* name server to hand over its zone — a packet reaches their infrastructure. WHOIS, Shodan, and LinkedIn are all passive (third-party sources). **Also active:** traceroute, ping, and banner grabbing.
Q3. An attacker successfully runs dig @ns.target.com target.com AXFR and receives every A, MX, NS, and SRV record for the zone. What was exploited?
- A. A buffer overflow in BIND
- B. A DNS server configured to allow zone transfers to any host
- C. A poisoned resolver cache
- D. An expired TLS certificate
Answer
**B. An open zone transfer.** AXFR is meant to sync a primary to its listed **secondaries**; a server that answers *anyone* is misconfigured and dumps the entire internal DNS map in one request. **Fix:** restrict transfers to named secondary IPs (one line). This is CEH's favorite "what did the attacker exploit?" answer.
Q4. Which DNS record type most directly helps an attacker locate a domain controller with no credentials?
- A. MX
- B. PTR
- C. SRV
- D. TXT
Answer
**C. SRV.** Service-locator records like `_ldap._tcp` and `_kerberos._tcp` advertise where AD services live, pointing straight at the DC. MX names mail servers, PTR does reverse lookups, and TXT holds SPF/DKIM/verification strings. **PAM takeaway:** keep AD DNS internal-only so these never face the internet.
Q5. A record holds the zone's serial number and the primary name server / admin email. Which record is it?
- A. NS
- B. SOA
- C. CNAME
- D. A
Answer
**B. SOA (Start of Authority).** It carries the primary NS, the responsible-party email, the serial, and the refresh/retry/expire timers. **NS** lists the authoritative servers — a classic swap trap. **CNAME** is an alias; **A** maps a host to IPv4.
Q6. Which Google dork returns only PDF files hosted on example.com?
- A.
site:example.com filetype:pdf
- B.
inurl:example.com pdf
- C.
cache:example.com/*.pdf
- D.
intitle:example.com filetype:pdf
Answer
**A. `site:example.com filetype:pdf`.** `site:` scopes to one domain; `filetype:` (or `ext:`) restricts by document type — the standard combo for hunting exposed documents. `inurl:` matches URL text, `cache:` fetches a stored copy, and `intitle:` matches the page title.
Q7. Which operator finds pages whose title contains a phrase, useful for spotting exposed directory listings like index of?
- A.
inurl:
- B.
link:
- C.
site:
- D.
intitle:
Answer
**D. `intitle:`** matches text in the page `` — e.g. `intitle:"index of" "backup"`, a GHDB pattern for exposed listings. `inurl:` matches the URL, `site:` scopes to a domain, and `link:` finds pages linking to a target. The curated catalog of these is the **Google Hacking Database (GHDB)**.
</details>
<hr />
<p><strong>Q8.</strong> You need to find <strong>internet-exposed devices</strong> for a target by their service banners (e.g. <code>hostname:example.com</code>, <code>net:198.51.100.0/24</code>). Which engine is purpose-built for this?</p>
<ul>
<li>A. Maltego</li>
<li>B. HTTrack</li>
<li>C. Shodan</li>
<li>D. Recon-ng</li>
</ul>
<details><summary>Answer</summary>
**C. Shodan** indexes internet-facing devices/services by banner and supports filters like `hostname:`, `net:`, `port:`, and `org:`. It is **passive** — you query Shodan's cache, not the target. **Censys** is the close cousin, adding TLS-certificate search. Maltego graphs relationships; HTTrack mirrors sites; Recon-ng is a module framework.
</details>
<hr />
<p><strong>Q9.</strong> Which tool is designed to gather <strong>emails, subdomains, and hostnames</strong> from public OSINT sources?</p>
<ul>
<li>A. theHarvester</li>
<li>B. HTTrack</li>
<li>C. Wireshark</li>
<li>D. Nikto</li>
</ul>
<details><summary>Answer</summary>
**A. theHarvester** pulls emails, subdomains, and hosts from search engines, certificate transparency, and other OSINT feeds. HTTrack mirrors websites, Wireshark sniffs traffic, and Nikto scans web servers. **Tool→role pairing is heavily tested — memorize it.**
</details>
<hr />
<p><strong>Q10.</strong> A pentester builds a visual <strong>link-analysis graph</strong> connecting a company's domains, people, and email addresses. Which tool fits?</p>
<ul>
<li>A. Maltego</li>
<li>B. Recon-ng</li>
<li>C. dnsrecon</li>
<li>D. Censys</li>
</ul>
<details><summary>Answer</summary>
**A. Maltego** specializes in graphing entities and their relationships (transforms). **Recon-ng** is a *modular framework* for OSINT collection, **dnsrecon** automates DNS enumeration, and **Censys** searches hosts/certs. Don't confuse the graphing tool (Maltego) with the framework (Recon-ng).
</details>
<hr />
<p><strong>Q11.</strong> Why do attackers use <strong>HTTrack</strong> to mirror a site offline instead of browsing it live?</p>
<ul>
<li>A. It bypasses authentication automatically</li>
<li>B. It is the only way to view HTML source</li>
<li>C. It decrypts HTTPS traffic</li>
<li>D. It lets them study source, comments, and paths without repeatedly hitting the live server</li>
</ul>
<details><summary>Answer</summary>
**D.** A local mirror means you can hunt HTML comments, internal paths, and email addresses in the source **without hammering the live site** — a stealth and efficiency motive. It neither bypasses auth nor decrypts TLS, and any browser can view source.
</details>
<hr />
<p><strong>Q12.</strong> Which <strong>regional internet registry</strong> would you query for IP allocation data covering <strong>Europe and the Middle East</strong>?</p>
<ul>
<li>A. ARIN</li>
<li>B. APNIC</li>
<li>C. LACNIC</li>
<li>D. RIPE NCC</li>
</ul>
<details><summary>Answer</summary>
**D. RIPE NCC.** Match registry to region: **ARIN** (North America), **RIPE NCC** (Europe/Middle East), **APNIC** (Asia-Pacific), **LACNIC** (Latin America), **AFRINIC** (Africa). Expect a "which registry serves region X" item.
</details>
<hr />
<p><strong>Q13.</strong> An attacker embeds a <strong>tracking pixel</strong> in an email to the target. What does this reveal?</p>
<ul>
<li>A. The recipient's password</li>
<li>B. The domain's zone file</li>
<li>C. The mail server's private key</li>
<li>D. When the mail was opened and the reader's approximate IP/location</li>
</ul>
<details><summary>Answer</summary>
**D.** An email tracking pixel / web-bug fires when the message is opened, leaking the **open time and the reader's IP/approximate location** (and sometimes client info). It's an *active* recon technique. Reading the mail **headers** separately traces the delivery path and originating servers.
</details>
<hr />
<p><strong>Q14.</strong> A defender wants to stop attackers from copying the <strong>entire internal DNS zone</strong>. Which control is most direct?</p>
<ul>
<li>A. Restrict zone transfers to listed secondary name servers</li>
<li>B. Enforce HSTS on the web server</li>
<li>C. Rotate the TLS certificate</li>
<li>D. Enable account lockout</li>
</ul>
<details><summary>Answer</summary>
**A. Restrict zone transfers** to the named secondary IPs (and prefer split-horizon / internal-only DNS for AD). That single change turns an open AXFR into a refusal. HSTS, cert rotation, and lockout address unrelated risks. **Verify by re-running `dig ... AXFR` and confirming a refusal.**
</details>
<hr />
<p><strong>Q15.</strong> Which pairing is <strong>correct</strong>?</p>
<ul>
<li>A. <code>cache:</code> is active; a live page fetch is passive</li>
<li>B. WHOIS is active; zone transfer is passive</li>
<li>C. Shodan is passive; traceroute is active</li>
<li>D. Ping is passive; Censys is active</li>
</ul>
<details><summary>Answer</summary>
**C. Shodan is passive; traceroute is active.** Shodan queries a third-party cache (passive); traceroute sends packets toward the target (active). `cache:` is passive and a live fetch is active (A is reversed); WHOIS is passive and AXFR is active (B is reversed); ping is active and Censys is passive (D is reversed).
</details>
<hr />
<h3 id="score-yourself">Score yourself<a class="headerlink" href="#score-yourself" title="Permanent link">¶</a></h3>
<ul>
<li><strong>13–15:</strong> solid — move on, revisit missed items in <a href="../facts/">facts.md</a>.</li>
<li><strong>10–12:</strong> re-read the DNS record types and passive-vs-active sections.</li>
<li><strong>< 10:</strong> re-read <a href="../">README.md</a> fully and redo the <a href="../lab-walkthrough/">lab-walkthrough.md</a>.</li>
</ul>
</article>
</div>
<script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script>
</div>
<button type="button" class="md-top md-icon" data-md-component="top" hidden>
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M13 20h-2V8l-5.5 5.5-1.42-1.42L12 4.16l7.92 7.92-1.42 1.42L13 8z"/></svg>
Back to top
</button>
</main>
<footer class="md-footer">
<div class="md-footer-meta md-typeset">
<div class="md-footer-meta__inner md-grid">
<div class="md-copyright">
Made with
<a href="https://squidfunk.github.io/mkdocs-material/" target="_blank" rel="noopener">
Material for MkDocs
</a>
</div>
</div>
</div>
</footer>
</div>
<div class="md-dialog" data-md-component="dialog">
<div class="md-dialog__inner md-typeset"></div>
</div>
<script id="__config" type="application/json">{"annotate": null, "base": "../../../../..", "features": ["navigation.indexes", "navigation.sections", "navigation.top", "navigation.tracking", "toc.follow", "content.code.copy", "search.suggest"], "search": "../../../../../assets/javascripts/workers/search.2c215733.min.js", "tags": null, "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}, "version": null}</script>
<script src="../../../../../assets/javascripts/bundle.d7400e89.min.js"></script>
</body>
</html>