Passive Recon Quiz: Can You Master OSINT Without Touching?

Submit

2. Which passive reconnaissance approach involves monitoring job postings to identify technologies and infrastructure a company uses?

Port enumeration

Workforce intelligence analysis

Vulnerability scanning

Protocol fuzzing

Submit

4. What is the key ethical principle that distinguishes legitimate passive reconnaissance from unauthorized surveillance?

Only using publicly available information with proper authorization

Avoiding all information gathering regardless of legality

Gathering data without any restrictions or limitations

Using encrypted channels for all reconnaissance activities

Submit

6. Which of these sources would be considered passive for threat intelligence gathering?

Directly querying the target's systems

Subscribing to public security feeds and CVE databases

Installing monitoring agents on the network

Launching exploit tools against systems

7. Passive reconnaissance using certificate transparency logs can reveal what information?

Plaintext passwords stored on web servers

Subdomains and domain ownership history

Real-time user session tokens

Encrypted database contents

8. What does MX record enumeration reveal during passive DNS reconnaissance?

Mail server information for the domain

Active user accounts on the network

Firewall rules and access control lists

Running services on port 25

Submit

10. Which social engineering reconnaissance method involves researching public information about employees without direct contact?

Phishing emails

Pretexting phone calls

OSINT research on social media and professional networks

Physical tailgating

11. Which tool is commonly used for passive DNS enumeration and does not directly query the target's nameservers?

Nslookup

DNSdumpster

Dig

Host

12. What is the primary risk of passive reconnaissance to the target organization?

It causes immediate denial of service

It reveals sensitive information that may enable further attacks

It automatically encrypts all network traffic

It has no risk because no interaction occurs

13. Which technique involves examining email headers and metadata without sending any packets to the target?

Ping sweeps

Email header analysis

TCP SYN scanning

ARP spoofing

14. What information can typically be obtained from reviewing a company's LinkedIn profiles passively?

System passwords and API keys

Employee names, titles, departments, and technologies used

Real-time network traffic patterns

Firewall configuration details

15. Google dorking is an example of passive reconnaissance because it relies on what?

Direct system access and exploitation

Publicly indexed search engine results

Network traffic analysis

Malware deployment and monitoring

16. Which public resource can reveal historical DNS records and previous IP addresses associated with a domain?

VirusTotal and PassiveDNS databases

The target organization's internal router logs

Active directory enumeration tools

Real-time packet capture files

17. What does OSINT stand for in the context of security research?

Open Source Intelligence

Offensive Security Incident Network Tools

Operational Security Integration Network

Online System Intrusion Notification Tracking

18. Shodan is primarily used for discovering what type of information about internet-connected devices?

Employee social media profiles

Exposed services, banners, and metadata

Encrypted password hashes

Active directory credentials

19. Which of the following is considered a passive reconnaissance technique?

Port scanning with Nmap

Reviewing cached web pages on the Wayback Machine

Running vulnerability assessments

Conducting network sniffing

20. What is the primary advantage of using WHOIS lookups during passive reconnaissance?

It reveals active listening ports on the target

It obtains registrant contact and domain ownership information

It bypasses firewall rules automatically

It identifies all running services on the network

Passive Recon Quiz: Can You Master OSINT Without Touching?

1. Passive reconnaissance differs from active reconnaissance primarily in that it does not ____.

2.

What first name or nickname would you like us to use?

2. Which passive reconnaissance approach involves monitoring job postings to identify technologies and infrastructure a company uses?

3. Company whitepapers and technical documentation discovered through passive research can reveal ____.

4. What is the key ethical principle that distinguishes legitimate passive reconnaissance from unauthorized surveillance?

5. Passive reconnaissance using the Wayback Machine provides information about ____.

6. Which of these sources would be considered passive for threat intelligence gathering?

7. Passive reconnaissance using certificate transparency logs can reveal what information?

8. What does MX record enumeration reveal during passive DNS reconnaissance?

9. GitHub repositories can reveal sensitive information during passive reconnaissance, such as ____.

10. Which social engineering reconnaissance method involves researching public information about employees without direct contact?

11. Which tool is commonly used for passive DNS enumeration and does not directly query the target's nameservers?

12. What is the primary risk of passive reconnaissance to the target organization?

13. Which technique involves examining email headers and metadata without sending any packets to the target?

14. What information can typically be obtained from reviewing a company's LinkedIn profiles passively?

15. Google dorking is an example of passive reconnaissance because it relies on what?

16. Which public resource can reveal historical DNS records and previous IP addresses associated with a domain?

17. What does OSINT stand for in the context of security research?

18. Shodan is primarily used for discovering what type of information about internet-connected devices?

19. Which of the following is considered a passive reconnaissance technique?

20. What is the primary advantage of using WHOIS lookups during passive reconnaissance?