Which statement best distinguishes active reconnaissance from passive in penetration testing?

• A. Passive reconnaissance requires direct interaction with the target to collect data.
• B. Active reconnaissance interacts with the target to gather information (e.g., port scans).
• C. Active reconnaissance uses only public sources with no direct contact.
• D. Passive reconnaissance analyzes only physical security measures.

Answer: (B)

In reconnaissance during penetration testing, the difference centers on whether you engage with the target while gathering data. Active reconnaissance involves direct interaction with the target systems to elicit responses and collect details—things like port scans, banner grabbing, or service discovery. This approach can reveal live hosts, open ports, services, and versions, but it also risks being detected.

Passive reconnaissance, on the other hand, collects information without touching the target, using public sources such as websites, DNS records, WHOIS data, and social media to infer the environment.

Therefore, the statement that active reconnaissance interacts with the target to gather information (for example, port scans) is the best distinction. The other descriptions mix up the interaction notion or mischaracterize passive methods.