Certified Ethical Hacker (CEH) Practice Question

Querying public Certificate Transparency (CT) logs is a fully passive activity because the tester only interacts with third-party CT search interfaces such as crt.sh or Google's CT API. CT logs contain most publicly trusted TLS certificates, and they often list subdomains that may never have been added to public DNS but were included in a certificate, revealing production, staging, and legacy hostnames without touching the target's network. In contrast, attempting a DNS zone transfer or performing word-list brute-force generates queries to the target's authoritative name servers, and fetching robots.txt sends requests directly to the target's web server-both actions violate the no-touch requirements.