GPEN Reconnaissance — Timed 10 Questions

Question 1

You are performing passive reconnaissance on a target organization. You decide to query DNS records to find subdomains that might be out of scope for the primary security team. Which tool is most effective for extracting subdomains via DNS zone transfers and brute-forcing common records?

10 minute time limit — choose an answer to begin.

Accepted Answer

Fierce. Passive reconnaissance relies on existing public records without directly interacting with target services. DNS enumeration is a critical phase for mapping the attack surface. While zone transfers are often disabled, tools like sublist3r or fierce utilize various techniques to identify hidden subdomains. Understanding how to query DNS without alerting the target is fundamental for a penetration tester to build an initial asset inventory before moving to active scanning phases.

Answer

Nmap with -sS flag

Answer

Netcat

Answer

Metasploit Auxiliary Modules

Question 2

During passive reconnaissance, you are analyzing an organization's public DNS records. Which THREE of the following record types are most useful for identifying infrastructure details?

Accepted Answer

MX (Mail Exchange). DNS records provide a map of an organization's digital presence. Identifying mail servers, authoritative name servers, and service-specific hostnames is a vital part of reconnaissance. By analyzing these records, a tester can determine how traffic flows and where services are hosted. These records form the basis for further exploration and target selection during the engagement. Knowing what each record type signifies is essential for professional network reconnaissance.

Answer

A (Address)

Answer

SOA (Start of Authority)

Question 3

You are tasked with gathering intelligence on an organization's cloud infrastructure. Which TWO of the following techniques would be most effective for discovering cloud-hosted assets?

Accepted Answer

Enumerating DNS subdomains for cloud-specific keywords. Cloud reconnaissance requires techniques that look beyond traditional on-premise IP ranges. By using tools to enumerate subdomains and examining DNS records for cloud-specific naming patterns, a tester can map cloud assets. Cloud providers often use unique identifiers in DNS that can be used to confirm the hosting provider. Mastering these cloud-centric reconnaissance techniques is necessary for modern engagements where the perimeter is increasingly distributed across various cloud service providers.

Answer

Running a full TCP port scan on the entire public IPv4 space

Answer

Attempting to brute-force the organization's corporate LDAP server

Answer

Performing a Man-in-the-Middle attack on the corporate Wi-Fi

Question 4

You are performing passive reconnaissance on a target organization. You decide to query DNS records to find subdomains that might be out of scope for the primary security team. Which tool is most effective for extracting subdomains via DNS zone transfers and brute-forcing common records?

10 minute time limit — choose an answer to begin.

Accepted Answer

GHDB with specialized search operators. Google Hacking Database (GHDB) queries are essential for uncovering misconfigured servers, directory listings, and exposed administrative portals. By using specialized search operators, testers bypass conventional site navigation to locate hidden infrastructure. This reconnaissance phase is vital because it reveals publicly accessible attack vectors without ever sending a packet directly to the target, minimizing the risk of triggering intrusion detection systems while maximizing the potential for discovering high-value vulnerabilities early in the engagement.

Answer

Nmap

Answer

Shodan

Answer

Wireshark

Question 5

You are performing passive reconnaissance on a target organization. You decide to query DNS records to find subdomains that might be out of scope for the primary security team. Which tool is most effective for extracting subdomains via DNS zone transfers and brute-forcing common records?

10 minute time limit — choose an answer to begin.

Accepted Answer

Harvest email addresses from public sources like LinkedIn, then validate them using a tool like Hunter.io. Passive email enumeration and verification should avoid direct interaction with the target. Public sources like LinkedIn provide candidate addresses, and third-party services can validate them using their own infrastructure. This approach minimizes the risk of alerting the target and keeps your activities stealthy. Direct SMTP commands or test emails are active and likely to be logged.

Answer

Perform a DNS zone transfer on the target's mail domain to extract a list of email addresses

Answer

Query the target's SMTP server with the VRFY command for each candidate address

Answer

Send test emails to candidate addresses and monitor for bounce-backs from the target's mail server

Question 6

During a penetration test, you are performing active reconnaissance on a target network. You want to identify live hosts without sending traditional ICMP echo requests, which are often blocked by firewalls. Which of the following nmap scan techniques would best accomplish this by using TCP SYN packets to common ports?

Accepted Answer

nmap -sS -p 80,443 192.168.1.0/24. The TCP SYN scan with -sS sends SYN packets to specified ports. If a host is live and the port is open, it responds with SYN-ACK, indicating the host is up. This method does not rely on ICMP and is stealthy because it does not complete the handshake. The other options either use ICMP, complete the handshake, or use UDP, which are less effective or stealthy in this scenario.

Answer

nmap -sn 192.168.1.0/24

Answer

nmap -sU -p 53 192.168.1.0/24

Answer

nmap -sT -p 80,443 192.168.1.0/24

Question 7

During an external penetration test, you want to enumerate hostnames and IP addresses associated with the target organization without triggering alerts on its perimeter. You have no prior relationship with the target and must rely solely on publicly available data. Which combination of resources would most directly provide a historical mapping of the organization's internet-facing infrastructure?

Accepted Answer

SecurityTrails and VirusTotal. SecurityTrails and VirusTotal both maintain passive DNS repositories that record historical domain-to-IP resolutions collected from recursive resolvers worldwide. Querying them reveals past and present A, AAAA, MX, and NS records, effectively reconstructing the organization's internet-facing footprint over time. Because the queries are made to third-party APIs and not to the target, no perimeter alerts are triggered, satisfying the passive and historical constraints.

Answer

TheHarvester and Maltego

Answer

Nmap and Masscan

Answer

Shodan and Censys

Question 8

During an authorized penetration test, you need to enumerate email addresses and employee names for a target organization without triggering any IDS alerts. You decide to use theHarvester. Which data source should you configure to maximize passive OSINT collection while ensuring zero direct contact with the target's infrastructure?

Accepted Answer

Hunter.io API. Hunter.io specializes in domain-to-email mapping and is designed for passive reconnaissance. When integrated with theHarvester, it queries Hunter's own database rather than the target, so no packets reach the target's infrastructure. This satisfies the requirement for zero direct contact and provides rich email and name data that other sources may lack.

Answer

HaveIBeenPwned API

Answer

Bing search engine

Answer

Shodan

Question 9

You are conducting passive reconnaissance against a target that uses a split-horizon DNS configuration. You have obtained a list of subdomains from a public certificate transparency log. Which action should you take next to determine which subdomains resolve to internal IP addresses without sending DNS queries to the target's authoritative nameservers?

Accepted Answer

Analyze the certificate transparency log for subject alternative names and IP addresses.. Certificate transparency logs are a passive source that can reveal internal hostnames and IP addresses through SAN entries. Because they are publicly accessible and pre-existing, analyzing them does not involve any direct interaction with the target's DNS infrastructure. This makes them ideal for split-horizon environments where public DNS queries would not return internal addresses.

Answer

Use a DNS cache snooping technique against the target's recursive resolver.

Answer

Query a public DNS resolver like 8.8.8.8 for each subdomain.

Answer

Perform a zone transfer (AXFR) against each authoritative nameserver.

Question 10

During OSINT gathering, you are investigating a target's presence on social media and professional networking sites. Which TWO of the following methods are effective for gathering metadata about employees to facilitate future social engineering attacks?

Accepted Answer

Extracting EXIF data from public photos. OSINT activities focus on harvesting publicly available information to profile individuals within an organization. By analyzing professional profiles and image metadata, an attacker gains insight into corporate hierarchies and technical stacks. This information is vital for crafting targeted phishing campaigns or pretexting scenarios. Understanding how to extract this data demonstrates a comprehensive approach to reconnaissance by focusing on the 'human' element alongside technical network infrastructure.

Answer

Performing a brute-force attack on the corporate firewall

Answer

Conducting a port scan of the internal network

Answer

Directly calling the IT helpdesk to request employee email addresses