ALL PASS, NO FAIL!

Home › Practice Questions › Module 2

CEH v13 Module 2: Footprinting & Reconnaissance — Free Practice Questions with Explanations

Last updated September 2026 · 10 questions · Module 2 of 20

Passive and active reconnaissance: OSINT tools, DNS/WHOIS interrogation, document metadata, and mapping the target attack surface. Exam focus: sort every technique as passive or active — whois lookups and document metadata leave no trace on the target, while port scans and zone transfers can trip alerts — and know which one each reconnaissance stage relies on.

⚠️ Important Disclaimer: These practice questions are original study material created by CEHStudy for educational purposes. They are NOT EC-Council exam questions and do NOT replicate the actual exam. CEHStudy is not affiliated with or endorsed by EC-Council.

Question 1: Passive footprinting is defined as:

Answer: A — Passive techniques include search engines, social media, public records, and WHOIS lookups — nothing touches the target directly, so detection risk is minimal.

Question 2: Which of the following is an example of ACTIVE footprinting?

Answer: A — A zone transfer query goes directly to the target's DNS servers, making it active — and more likely to be detected — unlike purely passive OSINT sources.

Question 3: Which command queries a domain's Mail Exchange (MX) records?

Answer: D — 'dig target.com MX' returns the mail servers for the domain. A-records map hostnames to IPv4, WHOIS covers registration data.

Question 4: Which tool aggregates email addresses and subdomains from hundreds of public sources including search engines, SSL certificates, and virtual hosts?

Answer: C — theHarvester (e.g., theHarvester -d target.com) pulls emails, subdomains, and hostnames from 200+ public sources — a core OSINT recon tool.

Question 5: FOCA is best described as a tool for:

Answer: A — FOCA (Find Out Come Access) extracts author names, company info, timestamps, tracked changes, and network paths from Office and PDF document metadata.

Question 6: Maltego is primarily used for:

Answer: D — Maltego builds visual graphs of relationships (people ↔ domains ↔ IPs ↔ companies) to map an organization's attack surface.

Question 7: An attacker can obtain a complete list of all hosts in a domain's DNS database via:

Answer: C — Zone transfers replicate the full DNS zone; if misconfigured and allowed to any client, 'dig axfr' exposes every hostname — a classic footprinting win.

Question 8: In 'thin' WHOIS systems, the registry database:

Answer: D — Thin WHOIS keeps minimal records centrally and defers full details to registrar servers; thick WHOIS stores complete data in one searchable database.

Question 9: Which Regional Internet Registry (RIR) serves the Americas?

Answer: A — ARIN covers the Americas; AFRINIC Africa; APNIC Asia-Pacific; RIPE NCC Europe/Middle East; LACNIC Latin America and the Caribbean.

Question 10: Shodan is best described as:

Answer: A — Shodan indexes banners, services, and devices on the internet — used to discover IoT/SCADA gear, open ports, and misconfigurations at scale (like Censys and ZoomEye).

Related Glossary Terms

Continue Your CEH v13 Prep

Frequently Asked Questions

How many CEH v13 Footprinting & Reconnaissance practice questions are on this page?

This page includes 10 original multiple-choice practice questions for CEH v13 Module 2 (Footprinting & Reconnaissance). Each question includes a detailed explanation of the correct answer and why the other options are wrong. The full CEHStudy question bank covers all 20 modules with 200+ questions — see the practice hub at https://cehstudy.com/ceh-practice-questions/ for every module.

What does CEH v13 Module 2 (Footprinting & Reconnaissance) cover?

Passive and active reconnaissance: OSINT tools, DNS/WHOIS interrogation, document metadata, and mapping the target attack surface. These are the same topics tested under this module on the EC-Council 312-50 exam. Pair this quiz with our free Module 2 flashcards at https://cehstudy.com/ceh-v13/module-02/ to close any gaps.

Are these real CEH exam questions?

No. Every question on CEHStudy is original study material written for exam preparation. They match the style, difficulty, and domain coverage of the actual CEH v13 exam but are not leaked or reproduced EC-Council questions.

How should I use this Footprinting & Reconnaissance quiz for exam prep?

Answer all 10 questions without peeking at explanations, then click "Show My Score". Review every explanation — especially the ones you missed — and re-test those topics with our free CEH flashcards. Aim for 80% or higher on module quizzes before scheduling the exam.

Where do I find CEH Footprinting & Reconnaissance flashcards?

Our free flashcard app covers all 20 CEH v13 modules including Module 2 (Footprinting & Reconnaissance). Visit the CEH flashcards page at https://cehstudy.com/ or the Module 2 page at https://cehstudy.com/ceh-v13/module-02/. No account or sign-up required.