ITPEC FE Morning April 2022 Question 41

Gathering information about an organization and its systems before an attack — footprinting is the attacker's reconnaissance step.

Before attacking, an intruder builds a profile of the target: domain names and IP address ranges, network layout, servers and software versions, employee names and e-mail addresses. Much of it comes from public sources such as the organization's website, DNS and WHOIS records and social media. Later steps, such as port scanning and exploiting a vulnerability, build on this information.

Answer (b)

Why not others:

• •(a) — forensic analysis is done by the defender after an incident to trace the attacker; footprinting is done by the attacker before the attack
• •(c) — listing the affected files is damage assessment after an attack, part of incident response
• •(d) — setting up an intrusion detection system is a defensive countermeasure, not gathering information about a target

Key rule: An attack runs in stages: reconnaissance, scanning, gaining access, then covering tracks; anything done "in preparation for an attack" belongs to reconnaissance.

Security · AI-written, may contain errors