PEN-200 Enumeration and Reconnaissance Practice Test 2 — 15 Questions

Question 1

When performing reconnaissance on an unknown network, you discover a service running on port 161. What is the most appropriate action to take to determine if this service can be abused?

Accepted Answer

Use snmpwalk to attempt to retrieve data using default community strings.. Port 161 is the default port for SNMP (Simple Network Management Protocol). Often, SNMP is misconfigured with default community strings like 'public' or 'private'. By testing these strings, a tester can potentially retrieve sensitive system information such as running processes, network interfaces, and even user accounts. This is a classic, high-value enumeration target that frequently yields significant information for further lateral movement or privilege escalation within the network environment.

Answer

Attempt a brute-force attack on the SSH service.

Answer

Run a full Nmap script scan for all protocols.

Answer

Ignore the port as it is rarely used for anything critical.

Question 2

You have identified an open port 445 on a Windows machine. Which tool is most effective for checking if the machine is vulnerable to common SMB-based exploits like EternalBlue?

Accepted Answer

Use Nmap with the --script smb-vuln-ms17-010 argument.. Nmap's scripting engine (NSE) is the most effective way to check for specific vulnerabilities like EternalBlue without requiring a full-scale vulnerability scanner. The 'smb-vuln-ms17-010' script is specifically designed to detect this vulnerability. Using such targeted scripts allows for accurate assessment with minimal footprint, which is a hallmark of professional penetration testing practices, ensuring the system's security posture is evaluated safely and effectively during the reconnaissance phase.

Answer

Use ping to verify the host is reachable.

Answer

Run a full Nessus scan against the IP.

Answer

Use telnet to manually send an exploit string.

Question 3

Which TWO of the following actions are considered best practice during the initial host enumeration phase to avoid detection by security monitoring tools?

Accepted Answer

Prioritize passive reconnaissance using OSINT sources.. To minimize detection, penetration testers should prioritize passive information gathering before engaging in active, noisy scanning. When active scanning is required, rate-limiting and targeting specific ports rather than performing a 'scan all' approach helps blend the traffic into normal network behavior. These practices are essential for maintaining the stealth required in professional engagements, ensuring that the tester remains undetected while collecting the necessary intelligence to identify high-value targets.

Answer

Perform a full port scan on all 65535 ports concurrently.

Answer

Use aggressive service detection flags in all scans.

Answer

Scan from the same IP address at all times.

Question 4

You are enumerating an Apache web server and discover the '.git' directory is accessible. What is the most significant risk this poses for your reconnaissance?

Accepted Answer

The entire source code repository can be downloaded.. An exposed '.git' directory allows an attacker to download the entire project repository, including source code, configuration files, and commit history. This is a critical discovery because the source code may contain hardcoded credentials, API keys, or sensitive business logic that would otherwise be hidden. Analyzing this data often provides the most direct path to exploitation, as it reveals the application's internal workings and potential flaws that are not apparent from the outside.

Answer

It indicates the server is using an outdated version of Apache.

Answer

It means the server is vulnerable to SQL injection.

Answer

It suggests that the server is running on a Windows OS.

Question 5

Refer to the exhibit. Which ports are currently open on the target host 192.168.1.10?

Accepted Answer

Ports 22 and 80.. The Nmap output clearly indicates the state of the scanned ports. In this exhibit, ports 22 and 80 are explicitly listed as 'open', while 998 others are closed. Identifying these specific ports is the first step in mapping the target's attack surface. Understanding how to read scan output is a core competency that allows a tester to prioritize their focus towards the services that are most likely to be exploitable.

Answer

All ports from 1 to 1000.

Answer

Only port 22.

Answer

No ports are open.

Question 6

You are performing reconnaissance and want to identify if a target website uses a specific CMS like WordPress. What is the most effective approach?

Accepted Answer

Use tools like whatweb or Wappalyzer.. Automated tools like 'wappalyzer' or 'whatweb' are highly effective at identifying the underlying technology stack of a web application. They analyze HTTP headers, source code patterns, and common file paths to detect CMS platforms. Identifying the CMS is critical because it allows the tester to focus on known vulnerabilities associated with that specific platform, rather than spending time on generic web assessments that may yield fewer results.

Answer

Manually inspect every image on the site.

Answer

Perform a denial-of-service attack.

Answer

Guess the CMS by looking at the page title.

Question 7

Which THREE of the following are considered 'active' reconnaissance techniques, as opposed to passive techniques?

Accepted Answer

Port scanning with Nmap.. Active reconnaissance involves direct interaction with the target system, which creates a visible footprint in server logs. Techniques like port scanning, service version detection, and directory brute-forcing are all active because they involve sending packets that the target must respond to. In contrast, passive reconnaissance uses third-party services to gather information without touching the target. Understanding this distinction is vital for maintaining the desired level of stealth throughout the reconnaissance and exploitation process.

Answer

WHOIS lookup.

Answer

Searching Google for public documents.

Question 8

You are performing a network scan on a client segment and notice that a host responds to ICMP echo requests but shows all TCP ports as 'filtered' when using Nmap. Which conclusion is most accurate?

Accepted Answer

A network-based firewall is likely dropping incoming TCP packets while allowing ICMP traffic to pass through.. The 'filtered' status indicates that a firewall or packet-filtering device is likely intercepting the TCP SYN packets and dropping them or sending prohibited ICMP error messages. Since the host responds to ICMP, the host is live, but the network path or host-based firewall prevents TCP probing. Understanding this distinction is critical for pivoting strategies and determining if the target's attack surface is truly closed or merely protected by perimeter security controls.

Answer

The target machine is powered off and the ICMP response is generated by a gateway device.

Answer

The target host is running a non-standard TCP/IP stack that ignores all incoming connection attempts.

Answer

The network interface on the target machine is misconfigured and unable to process TCP/IP traffic.

Question 9

You have successfully identified a Windows target and need to perform deep enumeration. Which TWO techniques are most effective for identifying hidden local services and internal network connections?

Accepted Answer

Execute 'netstat -ano' to identify local listening ports and associated process IDs.. Enumerating internal connections and services is essential for identifying lateral movement paths or local-only management interfaces. Using netstat confirms listening sockets that may not be exposed to the external network. Simultaneously, querying the Service Control Manager allows for the discovery of non-standard or custom services that might not be detected by typical port scans. Mastering these OS-specific enumeration techniques significantly increases the likelihood of finding vulnerabilities in non-obvious entry points.

Answer

Run 'nmap -sS -p- 127.0.0.1' from the target machine to map all possible services.

Answer

Analyze the 'hosts' file to find hidden DNS records for internal applications.

Answer

Check the system event logs for recent login attempts by administrative users.

Question 10

During an external penetration test, you discover a web server hosting multiple virtual hosts. You want to enumerate additional hostnames that resolve to the same IP address without triggering intrusion detection systems. Which technique is most appropriate?

Accepted Answer

Query public Certificate Transparency logs for certificates issued for the target domain.. Certificate Transparency logs are a passive reconnaissance resource that aggregates certificates issued for domains. By querying these logs, you can discover subdomains and virtual hostnames without interacting with the target. This avoids IDS alerts and is a standard OSINT technique. The other options involve active scanning or noisy DNS queries that are more likely to be detected.

Answer

Send HTTP requests with different Host headers to the web server and analyze responses.

Answer

Perform a DNS zone transfer (AXFR) against the authoritative name server.

Answer

Use a reverse DNS sweep of the IP address range to identify PTR records.

Question 11

During an internal assessment you run a TCP SYN scan and note that a host responds with an RST/ACK for every probed port. What does this behavior most reliably indicate about the target host?

Accepted Answer

The host is up and reachable, but no TCP listeners are present on the probed ports.. A TCP RST/ACK in response to a SYN is the standard signal of a closed but reachable port, because the kernel answers on behalf of a port with no bound listener. It confirms the host is alive and the path is unfiltered, letting you distinguish closed ports from filtered ones and focus subsequent service enumeration on ports that actually return SYN/ACK.

Answer

The target is running an IDS that spoofs resets to mislead the scanner.

Answer

The probed ports are open but the services are refusing the connection.

Answer

A stateful firewall is silently dropping the probe packets before they reach the host.

Question 12

During an internal penetration test, you run a UDP scan against a Linux server and see the following result: `161/udp open snmp`. You want to extract as much host information as possible without triggering authentication failures. Which command should you run first?

Accepted Answer

`snmpwalk -v2c -c public 10.10.10.25`. The most efficient first action is to query SNMP with the default read-only community string using `snmpwalk`. It both confirms the service is accessible and dumps a large amount of host data in one step. Brute-forcing or using SNMPv3 credentials is premature and risks detection or lockout without adding immediate value.

Answer

`onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt 10.10.10.25`

Answer

`snmpwalk -v3 -l authPriv -u admin -a SHA -A password 10.10.10.25`

Answer

`nmap -sU -p161 --script snmp-brute 10.10.10.25`

Question 13

You are performing active reconnaissance against a web server and want to identify hidden directories and files that may not be linked from the main site. Which two techniques are most appropriate for this goal? (Choose two.)

Accepted Answer

Using a tool like Gobuster with a wordlist to brute-force common directory and file names.. Brute-forcing with Gobuster and inspecting robots.txt are both effective for discovering hidden directories and files on a web server. Gobuster actively probes for common names, while robots.txt may list disallowed paths that administrators wish to keep out of search engines. The other techniques focus on port scanning, DNS, or registration data, which do not directly enumerate web content.

Answer

Running a full TCP port scan with Nmap to identify all open ports on the server.

Answer

Performing a WHOIS lookup to gather registration details about the domain.

Answer

Using the `dig` command to perform a zone transfer on the DNS server.

Question 14

You are enumerating a Linux host and find that UDP port 161 responds to SNMP queries with the community string 'public'. Which action yields the most useful reconnaissance data for planning later exploitation?

Accepted Answer

Run snmpwalk against the device to dump the MIB tree and extract system and interface information.. A working SNMP community string grants read access to the Management Information Base, and snmpwalk systematically dumps that tree. The resulting system descriptions, interface listings, and routing data give concrete enumeration value, exposing OS details and network layout that guide subsequent exploitation far better than any write, authentication, or trap-based approach.

Answer

Send SNMP traps to the device to force it to report its running configuration.

Answer

Use the community string to authenticate to the device over SSH on port 22.

Answer

Attempt an SNMP write operation using the same community string to alter device configuration.

Question 15

You are conducting a penetration test and need to identify the operating system of a target host without sending any packets to it. Which of the following methods is most appropriate?

Accepted Answer

Reviewing publicly available information such as job postings or technology stack details on the company's website.. Passive reconnaissance involves gathering information without directly interacting with the target. Reviewing public sources like job postings and website technology stacks can reveal the operating system without sending any packets. Active methods such as TTL analysis, Nmap OS detection, and banner grabbing all require sending packets to the target, violating the constraint.

Answer

Analyzing the Time-to-Live (TTL) values from a ping response.

Answer

Using Nmap's OS detection (-O) against the target IP address.

Answer

Performing a banner grab by connecting to open ports like 22 or 80.