Objective 5.5: Explain types and purposes of audits and assessments
Security+ SY0-701 practice question
A company hires a penetration testing firm for an unknown-environment test. The rules of engagement state that the first phase must be passive reconnaissance only, so no traffic may be sent to systems the company owns and no company employees may be contacted. Which TWO activities are permitted during this phase?
- Reading the company's job ads on third-party job boards(Correct)
Correct. Job ads on third-party job boards are public information that often reveals the platforms and products a company runs, and reading them sends nothing to the company's systems.
- Running a TCP SYN scan against its public IP address range
A SYN scan sends packets directly to the company's IP addresses to find open ports. That is active reconnaissance and is forbidden in this phase.
- Attempting a DNS zone transfer from its own name servers
A zone transfer attempt is a direct request to the company's own DNS servers, so it is active reconnaissance even if the request fails.
- Searching certificate transparency logs for subdomains(Correct)
Correct. Certificate transparency logs are public logs operated by third parties. Searching them reveals subdomains named in issued certificates without touching the company's systems.
- Grabbing the service banner from its mail server
Banner grabbing requires connecting to the company's mail server, which is direct interaction with a company system and therefore active.
- Calling the help desk while posing as a new hire
Pretexting the help desk is social engineering that directly engages company employees, which the rules of engagement forbid in this phase.
Explanation
Passive reconnaissance gathers information without interacting with the target's systems or people, typically from public, third-party sources (OSINT) such as job postings, social media, public records, search engines, and certificate transparency logs. Active reconnaissance sends traffic to the target or engages its staff, for example scanning, banner grabbing, zone transfer attempts, or social engineering, and can be detected.