GPEN Reconnaissance — 25 Questions

Question 1

You are performing passive reconnaissance on a target organization. You decide to query DNS records to find subdomains that might be out of scope for the primary security team. Which tool is most effective for extracting subdomains via DNS zone transfers and brute-forcing common records?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Fierce. Passive reconnaissance relies on existing public records without directly interacting with target services. DNS enumeration is a critical phase for mapping the attack surface. While zone transfers are often disabled, tools like sublist3r or fierce utilize various techniques to identify hidden subdomains. Understanding how to query DNS without alerting the target is fundamental for a penetration tester to build an initial asset inventory before moving to active scanning phases.

Answer

Nmap with -sS flag

Answer

Netcat

Answer

Metasploit Auxiliary Modules

Question 2

During passive reconnaissance, you are analyzing an organization's public DNS records. Which THREE of the following record types are most useful for identifying infrastructure details?

Accepted Answer

MX (Mail Exchange). DNS records provide a map of an organization's digital presence. Identifying mail servers, authoritative name servers, and service-specific hostnames is a vital part of reconnaissance. By analyzing these records, a tester can determine how traffic flows and where services are hosted. These records form the basis for further exploration and target selection during the engagement. Knowing what each record type signifies is essential for professional network reconnaissance.

Answer

A (Address)

Answer

SOA (Start of Authority)

Question 3

You are tasked with gathering intelligence on an organization's cloud infrastructure. Which TWO of the following techniques would be most effective for discovering cloud-hosted assets?

Accepted Answer

Enumerating DNS subdomains for cloud-specific keywords. Cloud reconnaissance requires techniques that look beyond traditional on-premise IP ranges. By using tools to enumerate subdomains and examining DNS records for cloud-specific naming patterns, a tester can map cloud assets. Cloud providers often use unique identifiers in DNS that can be used to confirm the hosting provider. Mastering these cloud-centric reconnaissance techniques is necessary for modern engagements where the perimeter is increasingly distributed across various cloud service providers.

Answer

Running a full TCP port scan on the entire public IPv4 space

Answer

Attempting to brute-force the organization's corporate LDAP server

Answer

Performing a Man-in-the-Middle attack on the corporate Wi-Fi

Question 4

You are performing passive reconnaissance on a target organization. You decide to query DNS records to find subdomains that might be out of scope for the primary security team. Which tool is most effective for extracting subdomains via DNS zone transfers and brute-forcing common records?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GHDB with specialized search operators. Google Hacking Database (GHDB) queries are essential for uncovering misconfigured servers, directory listings, and exposed administrative portals. By using specialized search operators, testers bypass conventional site navigation to locate hidden infrastructure. This reconnaissance phase is vital because it reveals publicly accessible attack vectors without ever sending a packet directly to the target, minimizing the risk of triggering intrusion detection systems while maximizing the potential for discovering high-value vulnerabilities early in the engagement.

Answer

Nmap

Answer

Shodan

Answer

Wireshark

Question 5

You are performing passive reconnaissance on a target organization. You decide to query DNS records to find subdomains that might be out of scope for the primary security team. Which tool is most effective for extracting subdomains via DNS zone transfers and brute-forcing common records?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Harvest email addresses from public sources like LinkedIn, then validate them using a tool like Hunter.io. Passive email enumeration and verification should avoid direct interaction with the target. Public sources like LinkedIn provide candidate addresses, and third-party services can validate them using their own infrastructure. This approach minimizes the risk of alerting the target and keeps your activities stealthy. Direct SMTP commands or test emails are active and likely to be logged.

Answer

Perform a DNS zone transfer on the target's mail domain to extract a list of email addresses

Answer

Query the target's SMTP server with the VRFY command for each candidate address

Answer

Send test emails to candidate addresses and monitor for bounce-backs from the target's mail server

Question 6

During a penetration test, you are performing active reconnaissance on a target network. You want to identify live hosts without sending traditional ICMP echo requests, which are often blocked by firewalls. Which of the following nmap scan techniques would best accomplish this by using TCP SYN packets to common ports?

Accepted Answer

nmap -sS -p 80,443 192.168.1.0/24. The TCP SYN scan with -sS sends SYN packets to specified ports. If a host is live and the port is open, it responds with SYN-ACK, indicating the host is up. This method does not rely on ICMP and is stealthy because it does not complete the handshake. The other options either use ICMP, complete the handshake, or use UDP, which are less effective or stealthy in this scenario.

Answer

nmap -sn 192.168.1.0/24

Answer

nmap -sU -p 53 192.168.1.0/24

Answer

nmap -sT -p 80,443 192.168.1.0/24

Question 7

During an external penetration test, you want to enumerate hostnames and IP addresses associated with the target organization without triggering alerts on its perimeter. You have no prior relationship with the target and must rely solely on publicly available data. Which combination of resources would most directly provide a historical mapping of the organization's internet-facing infrastructure?

Accepted Answer

SecurityTrails and VirusTotal. SecurityTrails and VirusTotal both maintain passive DNS repositories that record historical domain-to-IP resolutions collected from recursive resolvers worldwide. Querying them reveals past and present A, AAAA, MX, and NS records, effectively reconstructing the organization's internet-facing footprint over time. Because the queries are made to third-party APIs and not to the target, no perimeter alerts are triggered, satisfying the passive and historical constraints.

Answer

TheHarvester and Maltego

Answer

Nmap and Masscan

Answer

Shodan and Censys

Question 8

During an authorized penetration test, you need to enumerate email addresses and employee names for a target organization without triggering any IDS alerts. You decide to use theHarvester. Which data source should you configure to maximize passive OSINT collection while ensuring zero direct contact with the target's infrastructure?

Accepted Answer

Hunter.io API. Hunter.io specializes in domain-to-email mapping and is designed for passive reconnaissance. When integrated with theHarvester, it queries Hunter's own database rather than the target, so no packets reach the target's infrastructure. This satisfies the requirement for zero direct contact and provides rich email and name data that other sources may lack.

Answer

HaveIBeenPwned API

Answer

Bing search engine

Answer

Shodan

Question 9

You are conducting passive reconnaissance against a target that uses a split-horizon DNS configuration. You have obtained a list of subdomains from a public certificate transparency log. Which action should you take next to determine which subdomains resolve to internal IP addresses without sending DNS queries to the target's authoritative nameservers?

Accepted Answer

Analyze the certificate transparency log for subject alternative names and IP addresses.. Certificate transparency logs are a passive source that can reveal internal hostnames and IP addresses through SAN entries. Because they are publicly accessible and pre-existing, analyzing them does not involve any direct interaction with the target's DNS infrastructure. This makes them ideal for split-horizon environments where public DNS queries would not return internal addresses.

Answer

Use a DNS cache snooping technique against the target's recursive resolver.

Answer

Query a public DNS resolver like 8.8.8.8 for each subdomain.

Answer

Perform a zone transfer (AXFR) against each authoritative nameserver.

Question 10

During OSINT gathering, you are investigating a target's presence on social media and professional networking sites. Which TWO of the following methods are effective for gathering metadata about employees to facilitate future social engineering attacks?

Accepted Answer

Extracting EXIF data from public photos. OSINT activities focus on harvesting publicly available information to profile individuals within an organization. By analyzing professional profiles and image metadata, an attacker gains insight into corporate hierarchies and technical stacks. This information is vital for crafting targeted phishing campaigns or pretexting scenarios. Understanding how to extract this data demonstrates a comprehensive approach to reconnaissance by focusing on the 'human' element alongside technical network infrastructure.

Answer

Performing a brute-force attack on the corporate firewall

Answer

Conducting a port scan of the internal network

Answer

Directly calling the IT helpdesk to request employee email addresses

Question 11

Which of the following describes the purpose of using Google Dorks during the reconnaissance phase of a penetration test?

Accepted Answer

To identify publicly exposed sensitive files or directories.. Google Dorks are advanced search operators that allow testers to find sensitive information inadvertently indexed by search engines. This is a powerful form of passive reconnaissance that requires no interaction with the target infrastructure. By finding publicly exposed configuration files, logs, or login portals, testers can gain valuable intelligence. Mastering these operators is a fundamental skill for finding 'low hanging fruit' that often gets overlooked by automated scanning tools.

Answer

To bypass the target organization's firewall.

Answer

To execute remote code on the target's web server.

Answer

To perform a brute-force attack on user credentials.

Question 12

When mapping a target's network infrastructure, why is it important to use multiple WHOIS and regional internet registry (RIR) databases?

Accepted Answer

To identify all netblocks owned by the target organization.. Different RIRs manage different geographic segments of IP address space. Relying on a single database may result in an incomplete mapping of the organization's network assets. By aggregating data from various sources like ARIN, RIPE, or APNIC, a tester ensures a more accurate inventory of the target's netblocks. This reconnaissance step is critical for defining the scope of the assessment and identifying infrastructure that might be hosted by third-party providers.

Answer

To increase the speed of the DNS resolution process.

Answer

To bypass the need for an active port scan.

Answer

To automatically detect if a server is running an exploit.

Question 13

You are analyzing the results of a passive reconnaissance scan using a tool that harvests metadata from files found on a company website. What is the primary security risk associated with this information disclosure?

Accepted Answer

It discloses internal network naming conventions and software versions.. Metadata in files like PDFs or Word documents often includes internal paths, printer names, software versions used for creation, and author usernames. This information is a goldmine for an attacker attempting to build a social engineering lure or profile the target's workstation environment. Understanding that reconnaissance extends beyond network headers to document analysis is a hallmark of an advanced penetration tester who understands holistic information leakage.

Answer

The files can be used to execute arbitrary commands on the client machine.

Answer

It indicates the current load on the corporate web server.

Answer

It bypasses the need for an external vulnerability assessment.

Question 14

Why is it important to perform reconnaissance from a non-attributable source during a penetration test?

Accepted Answer

To avoid triggering security alerts that block the tester's IP.. Using non-attributable sources, such as a VPN or a compromised proxy, prevents the target from tracing reconnaissance activities back to the testing firm or the specific tester. This protects the anonymity of the test, ensuring that the target's security response is triggered based on the activity itself, rather than by blocking a known testing IP. This is essential for simulating a realistic threat actor's behavior and avoiding early detection.

Answer

To improve the speed of data transfer during scans.

Answer

To bypass the need for explicit written authorization.

Answer

To increase the accuracy of vulnerability detection tools.

Question 15

During the reconnaissance phase, you notice a target is using an older, unpatched version of a popular CMS. What is the most appropriate next step?

Accepted Answer

Research known CVEs for the identified version.. Identifying a vulnerable version of a CMS is a major reconnaissance success. The next step is to research known vulnerabilities (CVEs) associated with that version. This allows the tester to plan an exploit strategy without immediately running active, loud scans that might tip off the security team. This measured approach ensures that the eventual attack is precise, efficient, and well-supported by prior intelligence gathering efforts.

Answer

Immediately run a Metasploit exploit module against the server.

Answer

Contact the organization's IT department to report the vulnerability.

Answer

Ignore the CMS and look for other systems.

Question 16

What is the primary benefit of using passive reconnaissance before initiating active scanning?

Accepted Answer

To minimize the footprint of the testing engagement.. Passive reconnaissance gathers information without alerting the target, allowing the tester to build a comprehensive profile without being blocked. This minimizes the risk of triggering security systems early in the engagement. By understanding the organization's architecture through public sources first, the tester can perform more targeted and efficient active scanning later, significantly increasing the probability of success while reducing the likelihood of early detection by the security operations center.

Answer

To identify vulnerabilities without touching the server.

Answer

To guarantee access to the target's internal network.

Answer

To bypass the organization's internal intrusion detection systems.

Question 17

You are performing a reconnaissance task and need to identify the physical location or ownership of an organization's IP space. Which TWO of the following services are standard for this task?

Accepted Answer

WHOIS lookups. WHOIS and GeoIP databases are the industry standard for mapping network ownership and physical presence. WHOIS provides the registrant details for netblocks, while GeoIP services attempt to map IP addresses to physical coordinates. Together, they help a penetration tester understand the geographic footprint and administrative ownership of the target infrastructure, which is essential for accurate scoping and reporting of findings.

Answer

SSH brute-force tools

Answer

Packet sniffing on the target's Wi-Fi

Answer

Web browser history inspection

Question 18

During a reconnaissance project, you use the 'theHarvester' tool against a target. What information is this tool designed to extract?

Accepted Answer

Emails, subdomains, and user names from public sources.. theHarvester is a widely used OSINT tool designed to gather emails, subdomains, and hostnames from various public sources like search engines and PGP key servers. This information is vital for mapping the organization's digital footprint and identifying targets for social engineering. Its ability to aggregate this data from multiple sources makes it an essential tool for penetration testers aiming to build a comprehensive map of an organization's public-facing presence.

Answer

Internal employee passwords from active memory.

Answer

SQL injection vulnerabilities on web forms.

Answer

Full network topology maps including internal routers.

Question 19

You are conducting an external penetration test against a client who uses a split-horizon DNS configuration. You want to identify internal hostnames and IP addresses without sending any traffic to the client's internal network. Which of the following techniques would best accomplish this?

Accepted Answer

Analyze historical DNS data from passive DNS databases and certificate transparency logs. Split-horizon DNS separates internal and external views, so external queries won't reveal internal names. Passive DNS and certificate transparency logs are public data sources that may contain leaked internal hostnames from misconfigured certificates or historical records. These sources require no interaction with the target's infrastructure, making them ideal for stealthy reconnaissance.

Answer

Perform DNS cache snooping against the internal recursive resolver

Answer

Use DNS zone transfer requests against the external authoritative name servers

Answer

Query the internal DNS server directly using its private IP address

Question 20

You are conducting a penetration test for a client and need to enumerate subdomains of example.com to map their external attack surface. During this reconnaissance phase, you decide to use a tool that performs DNS zone transfers. Which of the following is the most appropriate tool to attempt a DNS zone transfer?

Accepted Answer

dig. The dig tool is specifically designed for DNS queries and supports the AXFR query type needed for zone transfer attempts. A successful zone transfer can reveal all DNS records, including subdomains, which is invaluable for mapping the target's external footprint. The other tools serve different reconnaissance purposes and cannot perform this function.

Answer

traceroute

Answer

nmap

Answer

whois