During the first phase of an authorized penetration test, testers collect employee names, email formats, and technology details from the company's website, social media, job postings, and public records, without sending any traffic to the company's systems. Which activity is this?

Reconnaissance gathers information about a target before exploitation. Passive reconnaissance collects information without directly interacting with the target's systems in a way that could be detected, typically through open-source intelligence such as public websites, social media, job postings that reveal technologies in use, public registration records, and search engines. Building a list of employee names, email formats, and technology details from those sources is classic passive reconnaissance. Active reconnaissance interacts directly with the target, for example by port scanning, banner grabbing, or enumerating services, which generates traffic that can be logged and detected; the scenario states that no traffic is sent to the company's systems. Integrated testing combines offensive and defensive activities so that attackers and defenders work together and share results, improving detection while testing; it describes the structure of the engagement rather than an information-gathering technique. Defensive testing evaluates detection and response capabilities; gathering information about a target is an offensive activity. Exam caveat: browsing a target's own public website is generally treated as passive because it is indistinguishable from normal visitor traffic, but scanning or crawling it aggressively is active. Operational check: confirm the rules of engagement specify when the test may move from passive to active reconnaissance.