Which statement correctly distinguishes passive from active reconnaissance?

• A. Passive reconnaissance uses social engineering; Active reconnaissance involves direct probing, such as an Nmap port scan.
• B. Passive reconnaissance collects data without direct interaction; e.g., WHOIS, DNS history; Active reconnaissance involves direct probing, such as an Nmap port scan.
• C. Passive is illegal; Active is legal.
• D. Passive uses automated tools; Active uses manual.

Answer: (B)

Passive reconnaissance is about gathering information without directly interacting with the target systems. It relies on public sources and data that are already available, such as WHOIS records and DNS history. This approach lets you learn about the target without directly touching or probing their network, making it quieter and less detectable.

Active reconnaissance, on the other hand, involves direct interaction with the target to discover live hosts, services, and configurations. A common example is an Nmap port scan, which sends probes to the target to see which ports are open and what services might be running. This provides concrete, actionable details about the target’s infrastructure but is more likely to trigger defenses.

Social engineering isn’t the defining difference between these modes, and legality isn’t determined solely by whether you’re being passive or active—permission and scope matter. Automated versus manual methods can appear in either approach, so the key distinction is the level of direct interaction with the target.