Phase 1 - Reconnaissance: What is attacker seeking to do?

Phase 1 - Reconnaissance: What is attacker seeking to do?

• A. Attacker seeks to gather info
• B. Passive and active
• C. Attacker deploys ransomware
• D. Attacker exploits weaknesses

Answer: (A)

Phase 1 reconnaissance is about gathering information to understand the target and plan the attack. The attacker’s objective is to collect data such as domain names, IP ranges, systems in use, network layout, employee roles, and potential weaknesses so they can map the attack surface and decide where to probe next. Techniques in this phase are categorized as passive (pulling public, non-interactive data) or active (querying or probing systems to learn more), but the core aim remains information gathering. Deploying ransomware or exploiting weaknesses are actions that come after enough information has been obtained and access is gained, not the initial goal of recon.

Phase 1 reconnaissance is about gathering information to understand the target and plan the attack. The attacker’s objective is to collect data such as domain names, IP ranges, systems in use, network layout, employee roles, and potential weaknesses so they can map the attack surface and decide where to probe next. Techniques in this phase are categorized as passive (pulling public, non-interactive data) or active (querying or probing systems to learn more), but the core aim remains information gathering. Deploying ransomware or exploiting weaknesses are actions that come after enough information has been obtained and access is gained, not the initial goal of recon.