CEH v13 Domain 2.1 Practice Test 001

Welcome to this CEH v13 practice test!

This practice test covers Domain 2 (Reconnaissance Techniques) Subdomain 1 (Footprinting and Reconnaissance) from the CEH v13 (312-50v13) exam blueprint (v5).

These questions are inspired by the EC-Council CEH exam and are designed to help you test your knowledge of ethical hacking tools, techniques, and methodologies. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CEH exam.

Note: CEH and Certified Ethical Hacker are registered trademarks of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CEH practice tests based on specific domains and subdomains, click that link.

CEH v13 Domain 2.1 Practice Test 001

10 questions • 8 single-answer, 2 multi-select

CEH v13 (312-50v13) • Domain 2: Reconnaissance Techniques — Sub-Domain 2.1: Footprinting and Reconnaissance

Question 1

A penetration tester has been hired to perform a black-box assessment against a financial services firm. Before making any direct contact with the target's systems, the tester wants to gather as much publicly available information as possible using Google search operators. The tester enters the following query into Google: `site:targetbank.com filetype:pdf "internal use only"` What type of footprinting technique is the tester employing?

A. WHOIS footprinting B. Google hacking / Google dorking C. DNS zone transfer D. Email header analysis

Question 2

Clark, a professional hacker, is in the early stages of targeting a multinational corporation. He visits the target organization's website and uses the browser's developer tools to examine the HTML source code, JavaScript files, and embedded metadata. He also runs the site through HTTrack to create a local mirror for offline analysis. Which footprinting methodology is Clark primarily using?

A. Network footprinting B. Email footprinting C. Website footprinting D. Social engineering footprinting

Question 3

During a footprinting exercise, a security analyst uses the Maltego tool to map relationships between a target company's employees, email addresses, domain names, IP addresses, and social media profiles. The analyst is able to visualize a comprehensive link graph showing how these entities are connected. What category of footprinting does this activity best represent?

A. DNS footprinting B. Competitive intelligence gathering C. Open Source Intelligence (OSINT) using footprinting tools D. Active reconnaissance

Question 4

Select all that apply

Jane is conducting footprinting against a target organization during a sanctioned red team engagement. She wants to gather email addresses and employee names associated with the target domain without directly contacting the organization's systems. (Choose TWO tools that are most appropriate for this goal.)

A. Nmap B. theHarvester C. Metasploit Framework D. Hunter.io E. Wireshark

Question 5

Elijah, a threat actor, wants to discover the IP address ranges, ASN (Autonomous System Number), and network blocks owned by a target organization before launching an attack. He queries the ARIN database and also uses tools like Whois and traceroute to map the target's internet-facing infrastructure. Which footprinting technique is Elijah performing?

A. DNS footprinting B. WHOIS footprinting combined with network footprinting C. Email footprinting D. Website footprinting

Question 6

A penetration tester performs a WHOIS lookup against a target domain and retrieves the following key pieces of information: registrar name, registration and expiration dates, name servers, and the administrative contact's email address. The tester then uses this email address to pivot into additional OSINT research. Which of the following is the MOST significant risk that WHOIS footprinting poses to an organization that does NOT use domain privacy services?

A. Exposure of internal firewall rule configurations B. Disclosure of administrative contact details enabling targeted spear-phishing C. Revelation of the organization's Active Directory structure D. Exposure of SSL/TLS certificate private keys

Question 7

During a footprinting engagement, Kevin uses Recon-ng with the `recon/domains-hosts/google_site_web` module to discover subdomains associated with a target organization. He then queries Shodan to identify internet-exposed services and device banners on the discovered hosts. This activity is BEST classified as which combination of footprinting techniques?

A. Email footprinting and DNS footprinting B. Footprinting through search engines and network footprinting C. Social engineering footprinting and WHOIS footprinting D. Website footprinting and active scanning

Question 8

Select all that apply

An ethical hacker is performing DNS footprinting against a target organization to gather intelligence about their mail infrastructure and zone configuration. (Choose TWO actions that are valid DNS footprinting techniques within the CEH methodology.)

A. Querying MX records to identify the organization's mail servers B. Running Nessus against the target's DNS server to identify CVEs C. Performing a DNS zone transfer request against the target's nameserver D. Using ARP poisoning to intercept DNS queries on the local network E. Using Nmap SYN scan to identify open ports on discovered IP addresses

Question 9

A security team is reviewing their organization's exposure to footprinting attacks. They discover that their corporate website's metadata reveals the software versions used, internal file paths, and author names of published documents. An attacker could extract this information using a tool like FOCA (Fingerprinting Organizations with Collected Archives). Which footprinting countermeasure BEST addresses this specific risk?

A. Implementing DNSSEC to authenticate DNS responses B. Sanitizing document metadata before publishing files to the public website C. Enabling two-factor authentication on all employee email accounts D. Deploying a web application firewall (WAF) to block SQL injection attempts

Question 10

Jane is conducting reconnaissance against a technology company as part of a red team engagement. She visits the company's LinkedIn page, Facebook profile, and Twitter/X feed to identify employee names, job titles, technologies used, recent projects, and organizational structure. She also monitors job postings to infer what technologies and security tools the organization currently uses. This footprinting technique is BEST described as:

A. Footprinting through social engineering B. Footprinting through social networking sites C. Competitive intelligence footprinting D. Email footprinting

Related Posts

Leave a Comment Cancel Reply