Which statement best describes OSINT during reconnaissance?

• A. Performing active exploit development
• B. Exploiting zero-day vulnerabilities
• C. Physically breaching a facility
• D. Gathering publicly available information about the target

Answer: (D)

Open Source Intelligence (OSINT) in reconnaissance means collecting information that is publicly available about the target to understand its assets, technologies, personnel, and potential weaknesses, without directly interacting with the target’s systems. This approach helps map the attack surface by gathering data from domains, WHOIS records, DNS, public registries, social media, company websites, press releases, public code repositories, and other open sources. OSINT is typically passive, focusing on what can be observed publicly rather than probing or exploiting systems.

This is why gathering publicly available information best describes OSINT. The other options involve actions that go beyond public information gathering—developing exploits, exploiting unknown vulnerabilities, or physically breaching a facility—none of which align with the open-source, information-collection focus of OSINT.