What Is Web Server Footprinting in CEH Reconnaissance?

312-50v12 By islever Editorial Last updated

Foot Printing and Reconnaissance

Short answer

D Web server footprinting gathers system-level data such as account details, server names, OS and software versions, and database schema details.

Question

When considering how an attacker may exploit a web server, what is web server footprinting?
  1. When an attacker creates a complete profile of the site's external links and file structures
  2. When an attacker uses a brute-force attack to crack a web-server password
  3. When an attacker implements a vulnerability scanner to identity weaknesses
  4. When an attacker gathers system-level data, including account details and server names Correct Answer

Key Takeaways

The question tests whether you can separate web server footprinting from website structure profiling, password cracking, and vulnerability scanning; the trap is selecting A because it also sounds like reconnaissance.

Web server footprinting is the CEH reconnaissance activity that collects system-level details about a target web server, including account data, server names, OS and software versions, and database schema information. This page explains why option D matches that definition and why options A, B, and C describe different activities.

Common mistake: Many learners choose A because profiling external links and file structures sounds like reconnaissance, but CEH uses that for website footprinting or mirroring; web server footprinting specifically targets system-level data such as server names and account details.

Expert Analysis

Why the Answer Is Correct

Web server footprinting, as CEH presents it, is the reconnaissance activity that collects system-level data about the target server: account details, operating system, software versions, server names, and database schema details. Option D matches that definition almost word for word, so it is the strongest answer even though the stem mentions how an attacker "may exploit" the server. Footprinting is not the exploitation itself; it is the information-gathering step that gives an attacker the profile needed for later exploitation. The community record also points this way: kevin403 states "I got full marks and this is one of the questions," and ET0722 references the course blueprint covering "server names, account details, and domains." shaody's paraphrase of the CEH definition also centers on system-level data such as account details and server names. Therefore, the answer is D.

Why the Other Options Are Wrong

Option A describes profiling external links and file structures, which is closer to website footprinting or website mirroring than to the CEH definition of web server footprinting. Option B is a brute-force password attack, a system hacking action that comes after reconnaissance and does not define footprinting. Option C is vulnerability scanning, which belongs to scanning/vulnerability analysis and actively probes for weaknesses rather than passively or semi-passively gathering system-level profile data. LeongCC argues for A and 3936e29 leans toward C because the stem says "may exploit," but the phrase frames the context for later exploitation, not the phase being defined. Thus B, C, and A all name other activities.

Community Comment Notes

The comments are split but mostly support D: sh4dali simply says "D is correct," and LordXander cites "CEHv12 - 1810," while ariel004 notes this is "old Question #: 362 from V11." LeongCC favors A because it "remains the best fit" for profiling links and file structures, but that reasoning conflates website content profiling with server-level footprinting. 3936e29 raises a fair point about the exploitation wording and suggests C, yet a vulnerability scanner is an active assessment tool rather than a footprinting technique. ET0722's course reference about a footprinting "blueprint" that includes server names and account details is the most useful tie-breaker for the CEH definition.

Exam Strategy

Map each option to the CEH phase before choosing: footprinting gathers information, scanning probes systems, and system hacking exploits credentials. If an option describes running a vulnerability scanner or brute-forcing a password, it is usually later than footprinting. Anchor the answer to the exact CEH phrase "system-level data" instead of the broader idea of profiling a website.

Frequently Asked Questions

Why is option A not web server footprinting when it profiles links and file structures?

A describes website footprinting or mirroring of site content; CEH defines web server footprinting as system-level data collection such as server names, OS versions, and account details.

Why does running a vulnerability scanner (C) not count as footprinting?

A vulnerability scanner actively probes for weaknesses during scanning or vulnerability analysis; footprinting is earlier information gathering that builds the server's system-level profile before exploitation.

More 312-50v12 FAQ →

Community Votes

D
69%
A
31%

69% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

  1. LeongCC 👍 4 Answered A
    I think the A is more suitable A. When an attacker creates a complete profile of the site's external links and file structures remains the best fit for the concept of web server footprinting as described in the context of the original question.
  2. kevin403 👍 2 Answered D
    D. I got full marks and this is one of the questions.
  3. 3936e29 👍 1 Answered C
    Well, I am not sure that D is correct in this specific case. The question says "When considering how an attacker MAY EXPLOIT a WEB SERVER". It's not general question about footprinting and getting knowledge about sites, employees, network range, physical location etc It is question directed at web server footprinting in the context of exploitation. I would say the answer is C, and this is about active footprinting that means finding services running and weaknesses (vulnerabilities) that could be exploited. My answer is C.
  4. ET0722 👍 1
    The course speaks of a "blueprint" that will be created when the footprinting is complete. This would include the server names, account details, and domains that are available from the company's footprint. I would think that D is the more accurate answer. Ref: Module 2 pg 107-108.
  5. shaody 👍 1 Answered D
    Gather valuable system-level data such as account details, operating system, software versions, server names, and database schema details
Show 5 more comments
  1. qwerty100 👍 1 Answered D
    D. When an attacker gathers system-level data, including account details and server names
  2. ariel004 👍 1
    old Question #: 362 from V11 - it's D
  3. nosavotor 👍 1
    Team is this CEH method correct
  4. sh4dali 👍 3 Answered D
    D is correct
  5. LordXander 👍 2 Answered D
    CEHv12 - 1810

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide