Passive, Active or Already Inside?

About this interactive

Passive reconnaissance never reaches your systems, so your own logs cannot record it; you hear of it, if at all, from an outside source. Active reconnaissance probes your systems from the internet, and your equipment can log it, which warns you that you may be a target. Discovery is reconnaissance from inside your network, a sign the attacker is already in. Each card is evidence from a log, an alert or a report: decide which of the three it shows.

What you'll learn

Read a defender’s evidence of a reconnaissance step and tell passive reconnaissance, active reconnaissance from the internet, and discovery from inside apart
Explain what each kind of step means for the defenders: whether their own logs can record it, and whether the attacker is still outside

Aligned to

CompTIA Security+

4.9 Given a scenario, use data sources to support an investigation.

4.4 Explain security alerting and monitoring concepts and tools.

CompTIA CySA+

1.2 Given a scenario, analyze indicators of potentially malicious activity.

Key terms

Reconnaissance: The first phase of an attack in which an adversary gathers information about a target — such as open ports, employee names, and technology stacks — before launching an attack. Reconnaissance can be passive (using public sources) or active (directly probing the target).
Passive Reconnaissance: An intelligence-gathering phase in which an attacker collects information about a target using only publicly available sources — such as WHOIS records, job postings, and social media — without directly interacting with the target's systems.
Active Reconnaissance: Intelligence gathering that involves direct interaction with a target system, such as port scanning or vulnerability scanning, which may trigger alerts.
Enumeration: The process of extracting detailed information about a target, such as counting users, groups, and network resources, going deeper than general reconnaissance.
Port Scanning: A technique used to discover open ports and services available on a networked device.
Intrusion Detection System: A system that monitors network or system activities for malicious behavior and generates alerts.
Threat Intelligence: Information about existing or emerging threats that helps organizations make informed security decisions.

Topics

Reconnaissance Interactive Predict

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →