Question

a penetration tester is trying to extract employee information during the reconnaissance phase. what kinds of data is the tester collecting about the employees?
operating systems, applications, security policies, and network mapping
contact names, phone numbers, email addresses, fax numbers, and addresses
geographical information, entry control systems, employee routines, and vendor traffic
intellectual property, critical business functions, and management hierarchy
i want to review this question later. (optional)

Explanation:

During the reconnaissance phase of penetration testing, when targeting employee-specific information, the tester collects direct personal contact details that can be used for social engineering or further targeted attacks. The other options focus on system/network data, physical access/operational data, or business-wide non-employee-specific data, not direct employee personal information.

Answer:

B. Contact names, phone numbers, email addresses, fax numbers, and addresses