A tester reviews public certificate-transparency records to identify possible subdomains without sending probes to the client's servers. What type of activity is this?

1. Persistence establishment
2. Privilege escalation
3. Passive reconnaissance
4. Authenticated vulnerability scanning