A parks assessment team discusses reconnaissance techniques. Which distinction is most accurate?
Select an answer to reveal the explanation.
Short Explanation
Reading public pages is passive; poking DNS harder is a different gear that still needs a clear ROE. Don't mash them into one 'whatever recon' bucket.
Full Explanation
Passive OSINT gathers from open sources without interacting with target systems in an active probing sense, while techniques such as certain DNS interrogations are more active and still require explicit ROE clarity. Parks and other municipal assessment teams that mash both into a single undifferentiated recon bucket understate authorization needs and can drift into unapproved interaction with civic infrastructure. Keeping the distinction protects legality and measurement discipline during AI-assisted recon.
Treating passive OSINT and active DNS interrogation as identical with no ROE nuance fails by concept: interaction intensity and authorization needs differ. Claiming active DNS interrogation is always illegal even with written authorization denies the role of scoped ROE that can permit carefully bounded active techniques. Asserting that passive OSINT requires more invasive packet injection than port scanning reverses the definitions and confuses passive collection with active network interaction.
Exam caveat: Definitions have gray zones—fetching public web pages is usually passive, but aggressive automated crawling, zone transfers, or crafted DNS queries may be treated as active depending on ROE language. When the ROE is silent, escalate rather than assume. Volume and timing against production resolvers matter as much as the technique label.
Operational check: Tag each recon task passive versus active in the runbook; require a ROE checkbox before DNS interrogation beyond simple public lookups documented as passive; and stop if responses indicate you are stressing production services until scope owners confirm.