FirstTry

Exam objective

CEH

Footprinting and Reconnaissance

This objective sits in Reconnaissance Techniques, which carries 17% of the CEH exam. The questions below are original, written from the official objective title above, and each explanation cites the EC-Council page it rests on.

Objective title verbatim from the official objectives. EC-Council exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

Reconnaissance Techniques

An analyst is building an egress allow list for an approved domain registration lookup tool and needs the port it uses. Which TCP port does a WHOIS server listen on?

TCP port 80Port 80 is cleartext HTTP. A registrar web form served there is a front end over the registry, not the protocol itself.
TCP port 53Port 53 carries DNS queries and responses, which is where the tool would resolve a name rather than read registration data.
TCP port 43Correct · your answerCorrect.
TCP port 389Port 389 belongs to LDAP directory lookups, useful when enumerating a directory but unrelated to domain registration.

Correct.

Checked against rfc-editor.org, September 2026

Concept

Registration lookup services run as their own protocol on a dedicated well known port, separate from name resolution and from web traffic, so an allow list has to name that port explicitly.

Why C

WHOIS is a transaction oriented query and response protocol whose servers listen on TCP 43. The client sends a text request, the server replies with text, and the closed connection signals the end of the answer.

Source

A WHOIS server listens on TCP port 43 for requests from WHOIS clients. The WHOIS client makes a text request to the WHOIS server, then the WHOIS server replies with text content.

IETF, RFC 3912: WHOIS Protocol Specification, checked September 2026
#footprinting#reconnaissance#osint

Now you: practice questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

Reconnaissance Techniques

An organization wants to publish an internal on-call phone roster in its domain registration record. A reviewer blocks the change. Which property of WHOIS supports that decision?

Sample question 2 of 3

Reconnaissance Techniques

A DNS administrator blocks all TCP traffic to an authoritative name server and leaves UDP 53 open. Ordinary lookups still work, but secondaries stop synchronizing. Which requirement explains it?

Sample question 3 of 3

Reconnaissance Techniques

A hosting team ships a name server image that answers every AXFR request from any address out of the box. What should the shipped default be instead?

That’s 3 of the full CEH bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Reconnaissance Techniques