PT0-002 Information Gathering and Vulnerability Scanning — 40 Questions

Question 1

During a vulnerability scan, a penetration tester notices that the scanner is repeatedly attempting to exploit a service, causing the service to crash and generating misleading findings. Which of the following scan configurations would BEST help the tester avoid this issue while still identifying potential vulnerabilities?

Accepted Answer

Activate the 'safe checks' option in the scanner. Option C is correct because the 'safe checks' option in vulnerability scanners (such as Nessus or OpenVAS) disables intrusive plug-ins that attempt to exploit services aggressively, which can cause service crashes. This configuration allows the scanner to identify potential vulnerabilities without disrupting the target service, avoiding misleading findings from crashed services.

Answer

Enable SYN scan instead of full TCP connect scan

Answer

Adjust the scan timing template to a slower rate

Answer

Increase the port range to include high ports

Question 2

A penetration tester is performing reconnaissance on a target organization and uses Shodan to find internet-facing devices. Which of the following is the BEST use case for Shodan in this context?

Accepted Answer

Discovering open ports and services on public IP ranges. Shodan is a search engine for internet-connected devices that scans public IP ranges and indexes the banners returned by services. Its primary use in reconnaissance is to discover open ports and running services on target IP ranges, revealing attack surface such as exposed databases, web servers, or industrial control systems. This aligns directly with the information-gathering phase of a penetration test.

Answer

Identifying subdomains through DNS brute-forcing

Answer

Enumerating email addresses from corporate websites

Answer

Extracting metadata from documents found on the target's website

Question 3

During the reconnaissance phase, a penetration tester wants to map out the target's DNS infrastructure without directly interacting with the target's servers. Which of the following techniques BEST achieves this?

Accepted Answer

Querying publicly available DNS records. Option B is correct because querying publicly available DNS records (e.g., via passive DNS, WHOIS, or DNS dumpster) allows the tester to gather DNS information without any direct interaction with the target's servers. This technique relies on third-party databases and cached records, avoiding any packets sent to the target, which is essential for stealth during reconnaissance. It aligns with passive information gathering, as defined in the PT0-002 objectives.

Answer

Performing a DNS zone transfer

Answer

Using Nmap to scan for DNS servers

Answer

Sending crafted DNS queries to the target's DNS server

Question 4

A penetration tester is conducting passive reconnaissance on a target organization. Which of the following techniques would provide the MOST useful information about internal network architecture without directly interacting with the target's systems?

Accepted Answer

Searching for the target's SSL certificates in Certificate Transparency logs. Certificate Transparency (CT) logs are publicly accessible, append-only ledgers of SSL/TLS certificates. By searching CT logs for certificates issued to the target organization, a penetration tester can discover subdomains, hostnames, and even internal-facing server names that are included in Subject Alternative Names (SANs) or Common Names (CNs). This reveals internal network architecture details (e.g., 'mail.internal.example.com') without any direct interaction with the target's systems, making it a purely passive reconnaissance technique.

Answer

Performing a zone transfer against the target's DNS servers

Answer

Using Nmap to scan common ports on the target's public IP range

Answer

Querying the target's WHOIS records for IP addresses

Question 5

A penetration tester is using a vulnerability scanner to assess an internal network. The scanner reports a critical vulnerability in a custom web application, but manual verification shows the application is not vulnerable. Which of the following is the MOST likely cause of this false positive?

Accepted Answer

The scanner detected a vulnerable library used by the application, but the application's implementation does not expose the vulnerable code path. Option C is correct because vulnerability scanners often identify libraries or components with known CVEs, but they cannot determine whether the application's code actually invokes the vulnerable functions. In this case, the scanner flagged a library with a known vulnerability, but the custom web application's implementation does not expose the vulnerable code path, resulting in a false positive. This is a common limitation of static or version-based detection versus dynamic, context-aware analysis.

Answer

The scanner used an outdated vulnerability database that does not match the application's patches

Answer

The scanner identified the application version from the HTTP response header, but the vulnerability was already patched in that version

Answer

The scanner performed an exploit attempt that succeeded on a different service on the same host

Question 6

A penetration tester is conducting an internal network scan and wants to minimize the chance of detection by the target's intrusion detection system (IDS). Which Nmap timing template is the MOST appropriate for this goal?

Accepted Answer

T0 (Paranoid). The T0 (Paranoid) timing template is the most appropriate because it introduces an extremely slow scan rate, sending packets at a rate of no more than one packet every 5 minutes (300 seconds). This slow pace is designed to evade threshold-based intrusion detection systems (IDS) that trigger alerts when they detect a high volume of traffic from a single source within a short time window, making it ideal for stealthy internal reconnaissance.

Answer

T1 (Sneaky)

Answer

T3 (Normal)

Answer

T5 (Insane)

Question 7

A penetration tester is using a vulnerability scanner on a web application and notices that many findings are false positives caused by the scanner sending oversized payloads that the application truncates or rejects. Which scanner configuration change would MOST effectively reduce false positives in this scenario?

Accepted Answer

Enable safe checks or anti-false positive mode. Enabling safe checks or anti-false positive mode configures the scanner to send payloads that conform to expected application input constraints (e.g., length limits, character sets) rather than oversized or malformed payloads. This reduces false positives by ensuring that the scanner only reports vulnerabilities that are actually reachable and exploitable under normal application behavior, rather than triggering truncation or rejection logic that is not a security flaw.

Answer

Increase the scan intensity to send more payloads

Answer

Increase the HTTP request timeout

Answer

Disable vulnerability detection for certain plugins

Question 8

During the reconnaissance phase, a penetration tester wants to identify subdomains of a target domain without making direct requests to the target's own DNS servers. Which technique would be BEST for this purpose?

Accepted Answer

Using search engines and public certificate transparency logs. Option C is correct because search engines (e.g., Google dorking) and public certificate transparency logs (e.g., crt.sh) allow a tester to discover subdomains by querying aggregated historical DNS and TLS certificate data, without sending any queries to the target's authoritative DNS servers. This passive reconnaissance technique avoids alerting the target's infrastructure and complies with the requirement of no direct requests to the target's DNS servers.

Answer

Using the 'nslookup' command interactively

Answer

Performing a zone transfer

Answer

Using the 'host' command

Question 9

During a penetration test, a vulnerability scanner reports a critical SQL injection vulnerability in a web application. However, manual testing shows that the parameter is not injectable due to proper parameterized queries. Which of the following is the MOST likely cause of this false positive?

Accepted Answer

The scanner matched a generic error message that is not specific to SQL injection. A vulnerability scanner often relies on pattern matching in HTTP responses to flag SQL injection. If the application returns a generic error message (e.g., 'An error occurred') after sending a malicious payload, the scanner may incorrectly classify it as SQL injection. However, because the application uses parameterized queries, the payload is safely handled, and the error is unrelated to SQL syntax — making this a classic false positive caused by generic error message matching.

Answer

The scanner used a payload that caused a different error unrelated to SQL injection

Answer

The scanner detected a stored XSS instead

Answer

The scanner tested a different parameter than what was reported

Question 10

During reconnaissance, a penetration tester discovers a public GitHub repository belonging to the target organization. The repository contains internal project names, server IP addresses, and code comments with database credentials. Which reconnaissance technique does this represent?

Accepted Answer

OSINT (Open-Source Intelligence). The discovery of a public GitHub repository containing internal project names, server IP addresses, and database credentials is a classic example of OSINT (Open-Source Intelligence). OSINT involves collecting and analyzing publicly available information from sources like code repositories, social media, and websites to gain insights about a target without direct interaction. This technique leverages the fact that sensitive data is often inadvertently exposed in public repositories, making it a passive reconnaissance method.

Answer

DNS enumeration

Answer

Port scanning

Answer

Social engineering

Question 11

A penetration tester wants to discover email addresses associated with a target domain (example.com) without sending any network packets to the target's systems. Which technique is BEST suited for this?

Accepted Answer

Google dorking. Google dorking uses advanced search operators (e.g., site:example.com intext:@example.com) to index publicly available information from Google's cached pages, allowing discovery of email addresses without sending any packets to the target's infrastructure. This passive reconnaissance technique relies solely on pre-existing search engine data, making it ideal for avoiding direct interaction with the target.

Answer

DNS brute forcing

Answer

WHOIS lookup

Answer

SMB enumeration

Question 12

A penetration tester wants to perform a network scan that minimizes the chance of detection by an intrusion detection system (IDS). Which Nmap timing template is MOST appropriate?

Accepted Answer

-T0. The -T0 (Paranoid) timing template is the most appropriate for minimizing detection by an IDS because it introduces extreme delays between packet transmissions (up to 5 minutes between probes) and uses a very slow scan rate. This makes the scan traffic blend into normal network noise, reducing the likelihood of triggering signature-based or anomaly-based IDS alerts that rely on detecting rapid, sequential connection attempts.

Answer

-T3

Answer

-T5

Answer

-T2

Question 13

A penetration tester is conducting passive reconnaissance against a target domain. The tester wants to discover all subdomains associated with the domain without making any direct DNS queries to the target's authoritative servers. Which technique is BEST suited for this purpose?

Accepted Answer

Querying certificate transparency logs using a site like crt.sh. Certificate transparency logs, accessible via sites like crt.sh, provide a historical record of all SSL/TLS certificates issued for a domain, including those for subdomains. Querying these logs allows a tester to discover subdomains without making any direct DNS queries to the target's authoritative servers, thus remaining fully passive and avoiding detection.

Answer

Using the 'nslookup' command to query the domain's DNS server

Answer

Performing a DNS zone transfer

Answer

Using the 'whois' lookup to gather domain registration info

Question 14

A penetration tester wants to enumerate user accounts and SMB shares from a Windows machine without authenticating. Which tool is specifically designed for this purpose and is commonly used in Linux penetration testing distributions?

Accepted Answer

enum4linux. enum4linux is specifically designed to enumerate user accounts, SMB shares, and other information from Windows machines via the SMB protocol without requiring authentication. It leverages the SMB null session vulnerability (CVE-1999-0504) to query the remote system for data such as user lists, share lists, and OS details, making it a standard tool in Linux penetration testing distributions like Kali Linux.

Answer

nmap

Answer

smbclient

Answer

hydra

Question 15

A penetration tester is performing reconnaissance on a target organization. The tester wants to discover the internal IP address scheme used by the company without making any direct connections to the company's network. Which technique is MOST effective for this purpose?

Accepted Answer

Analyzing job postings for technical requirements. Analyzing job postings for technical requirements is the most effective technique because it allows the tester to infer the internal IP address scheme without making any direct connections to the target network. Job postings often list specific technical skills, such as experience with certain subnet masks (e.g., /24, /16) or network ranges (e.g., 10.x.x.x, 192.168.x.x), which can reveal the internal addressing structure used by the organization. This passive reconnaissance method relies on publicly available information, avoiding any network traffic that could trigger detection.

Answer

DNS zone transfer

Answer

WHOIS lookup

Answer

Using Shodan to find exposed devices

Question 16

A vulnerability scanner reports a reflected XSS vulnerability in a web application. Manual testing confirms that the application HTML-encodes all user input in the response. Which scanner misconfiguration is MOST likely causing this false positive?

Accepted Answer

The scanner's payload triggered a server error that echoed back the input without encoding. Option D is correct because a server error that echoes back the unencoded input bypasses the application's normal HTML-encoding logic. In this scenario, the vulnerability scanner detects the reflected payload in the error response, which is not subject to the same encoding as the application's standard output. This creates a false positive because the reflected XSS is not exploitable through the normal application flow, but only through an error condition that the scanner inadvertently triggered.

Answer

The scanner used a POST request instead of a GET request for the payload

Answer

The scanner's payload was reflected in a different context not subject to HTML encoding

Answer

The scanner used a payload with special characters that were truncated by the server

Question 17

A penetration tester is conducting passive reconnaissance on a target organization. The tester wants to identify the technologies and frameworks used by the target's web application without making any requests to the target's servers. Which resource is BEST suited for this task?

Accepted Answer

BuiltWith.com. BuiltWith.com is a passive reconnaissance resource that profiles web application technologies by analyzing publicly available data, such as JavaScript libraries, web frameworks, and analytics tools, without sending any requests to the target's servers. It aggregates information from various public sources and historical data, making it ideal for identifying technologies without direct interaction.

Answer

Nmap service scan with -sV

Answer

Shodan.io

Answer

Wappalyzer browser extension

Question 18

A penetration tester receives an Nmap scan report showing that port 445/TCP is open on a target Windows host. The tester wants to determine if the host is vulnerable to EternalBlue (MS17-010) without triggering an alert. Which Nmap NSE script is most appropriate to use?

Accepted Answer

smb-vuln-ms17-010.nse. The smb-vuln-ms17-010.nse script is specifically designed to check for the EternalBlue vulnerability (MS17-010) by sending crafted SMB transactions to trigger a known response pattern, without exploiting the vulnerability itself. This makes it ideal for stealthy detection because it does not execute the actual exploit code that would cause a crash or generate an alert in a properly monitored environment.

Answer

smb-enum-shares.nse

Answer

smb-os-discovery.nse

Answer

smb-enum-users.nse

Question 19

During passive reconnaissance, a penetration tester wants to compile a list of valid employee email addresses for a target company to be used in a future phishing campaign. Which technique is LEAST likely to be detected by the target or its security controls?

Accepted Answer

Mining GitHub repositories for company email patterns. Option D is correct because mining GitHub repositories for email patterns is a passive reconnaissance technique that relies on publicly accessible code and commit histories. The target company has no visibility into GitHub's public data, and no direct interaction with the target's systems occurs, making it the least likely to trigger alerts or be detected by security controls such as IDS/IPS, email gateways, or network monitoring.

Answer

Using theHarvester to search public sources

Answer

Sending probe emails to validate addresses

Answer

Scraping LinkedIn profiles for email patterns

Question 20

A penetration tester is tasked with discovering all publicly accessible Amazon S3 buckets that belong to a target company. Which technique is MOST effective for this purpose?

Accepted Answer

Querying Google dorks for 'site:s3.amazonaws.com [target_company]'. Option D is correct because Google dorks allow a penetration tester to search for indexed S3 bucket URLs that contain the target company's name, revealing publicly accessible buckets without direct interaction with the target's infrastructure. This technique leverages Google's crawlers to find buckets that may have been inadvertently exposed or misconfigured, making it highly effective for passive reconnaissance.

Answer

Scanning the target's IP ranges for open ports 443

Answer

Using dnsdumpster.com to find subdomains

Answer

Guessing bucket names based on common patterns