Exercise 1: Classifying Recon Activities as Passive or Active — Possible Solution ==================================================================== (a) A WHOIS LOOKUP -> PASSIVE ------------------------------ Per this chapter, passive recon "gathers information without directly interacting with the target's own systems." A WHOIS lookup queries a third-party registry/registrar's own database, not any system the target itself operates. Nothing reaches a system the target controls, so nothing can appear in the target's own logs. (b) A PORT SCAN AGAINST THE TARGET'S OWN SERVER -> ACTIVE ------------------------------ Per this chapter, active recon means "direct interaction with the target's own infrastructure." A port scan sends packets directly to the target's own server, which is exactly the kind of interaction the chapter says "could show up in their own logs." This is unambiguously active. (c) A LINKEDIN SEARCH FOR THE TARGET'S EMPLOYEES -> PASSIVE ------------------------------ This queries LinkedIn's own platform/database, not any system the target itself operates. Per the chapter's own OSINT section, employee enumeration via LinkedIn is listed as a form of OSINT, and OSINT techniques of this kind are passive because they rely on already-public information hosted by a third party, not direct interaction with target-controlled infrastructure. (d) A DNS QUERY SENT DIRECTLY TO THE TARGET'S OWN AUTHORITATIVE NAMESERVER -> ACTIVE ------------------------------ This is the chapter's own explicit example: "even something as simple as a DNS query sent to the target's own authoritative nameserver... counts as active, since it touches systems the target actually controls and could show up in their own logs." Even though this looks similar to other "just checking DNS" activities, querying the TARGET'S OWN nameserver specifically (rather than a public/third-party resolver) crosses into direct interaction with target-controlled infrastructure. WHY THIS WORKS AS AN ANSWER ------------------------------ It applies the chapter's own defining test for each category — whether the activity interacts with a system the TARGET itself controls — to each of the four examples individually, rather than classifying by surface similarity (e.g. assuming all DNS-related activity is the same category).