Certified Ethical Hacker (CEH) Practice Question

Querying the public WHOIS database is considered passive footprinting because the request is sent only to the registrar's servers, not to any host owned by the target organization. No traffic ever touches the client's infrastructure, so intrusion-detection systems or firewalls at the target cannot see or log the activity. All the other actions-an Nmap UDP scan, SMB null-session enumeration, and requesting a DNS zone-transfer from the authoritative name server-generate direct traffic to the victim network and therefore constitute active reconnaissance, increasing the risk of detection.