PT0-002 Information Gathering and Vulnerability Scanning Practice Test 2 — 15 Questions

Question 1

A vulnerability scanner reports a reflected XSS vulnerability in a web application. Manual testing confirms that the application HTML-encodes all user input in the response. Which scanner misconfiguration is MOST likely causing this false positive?

Accepted Answer

The scanner's payload triggered a server error that echoed back the input without encoding. Option D is correct because a server error that echoes back the unencoded input bypasses the application's normal HTML-encoding logic. In this scenario, the vulnerability scanner detects the reflected payload in the error response, which is not subject to the same encoding as the application's standard output. This creates a false positive because the reflected XSS is not exploitable through the normal application flow, but only through an error condition that the scanner inadvertently triggered.

Answer

The scanner used a POST request instead of a GET request for the payload

Answer

The scanner's payload was reflected in a different context not subject to HTML encoding

Answer

The scanner used a payload with special characters that were truncated by the server

Question 2

A penetration tester is conducting passive reconnaissance on a target organization. The tester wants to identify the technologies and frameworks used by the target's web application without making any requests to the target's servers. Which resource is BEST suited for this task?

Accepted Answer

BuiltWith.com. BuiltWith.com is a passive reconnaissance resource that profiles web application technologies by analyzing publicly available data, such as JavaScript libraries, web frameworks, and analytics tools, without sending any requests to the target's servers. It aggregates information from various public sources and historical data, making it ideal for identifying technologies without direct interaction.

Answer

Nmap service scan with -sV

Answer

Shodan.io

Answer

Wappalyzer browser extension

Question 3

A penetration tester receives an Nmap scan report showing that port 445/TCP is open on a target Windows host. The tester wants to determine if the host is vulnerable to EternalBlue (MS17-010) without triggering an alert. Which Nmap NSE script is most appropriate to use?

Accepted Answer

smb-vuln-ms17-010.nse. The smb-vuln-ms17-010.nse script is specifically designed to check for the EternalBlue vulnerability (MS17-010) by sending crafted SMB transactions to trigger a known response pattern, without exploiting the vulnerability itself. This makes it ideal for stealthy detection because it does not execute the actual exploit code that would cause a crash or generate an alert in a properly monitored environment.

Answer

smb-enum-shares.nse

Answer

smb-os-discovery.nse

Answer

smb-enum-users.nse

Question 4

During passive reconnaissance, a penetration tester wants to compile a list of valid employee email addresses for a target company to be used in a future phishing campaign. Which technique is LEAST likely to be detected by the target or its security controls?

Accepted Answer

Mining GitHub repositories for company email patterns. Option D is correct because mining GitHub repositories for email patterns is a passive reconnaissance technique that relies on publicly accessible code and commit histories. The target company has no visibility into GitHub's public data, and no direct interaction with the target's systems occurs, making it the least likely to trigger alerts or be detected by security controls such as IDS/IPS, email gateways, or network monitoring.

Answer

Using theHarvester to search public sources

Answer

Sending probe emails to validate addresses

Answer

Scraping LinkedIn profiles for email patterns

Question 5

A penetration tester is tasked with discovering all publicly accessible Amazon S3 buckets that belong to a target company. Which technique is MOST effective for this purpose?

Accepted Answer

Querying Google dorks for 'site:s3.amazonaws.com [target_company]'. Option D is correct because Google dorks allow a penetration tester to search for indexed S3 bucket URLs that contain the target company's name, revealing publicly accessible buckets without direct interaction with the target's infrastructure. This technique leverages Google's crawlers to find buckets that may have been inadvertently exposed or misconfigured, making it highly effective for passive reconnaissance.

Answer

Scanning the target's IP ranges for open ports 443

Answer

Using dnsdumpster.com to find subdomains

Answer

Guessing bucket names based on common patterns

Question 6

A penetration tester is performing passive reconnaissance against a target domain. Which of the following resources can be used to gather information about the target without directly sending packets to the target's network? (Select two.) (Choose 2.)

Accepted Answer

Shodan. Shodan is a search engine that scans the internet for devices and services, indexing banners and metadata from publicly exposed systems. Since it queries its own pre-collected database rather than sending packets to the target's network, it qualifies as passive reconnaissance. This allows a penetration tester to discover open ports, services, and even specific vulnerabilities associated with the target domain without direct interaction.

Answer

Nmap

Answer

hping3

Question 7

A penetration tester is using Nmap to scan a target web server. The tester only wants to see which of the top 100 ports are open, but wants to minimize network traffic and time. Which Nmap command is most appropriate?

Accepted Answer

nmap -sV --top-ports 100 target. Option D is correct because `--top-ports 100` instructs Nmap to scan only the 100 most commonly open ports, which minimizes network traffic and time compared to scanning all ports or a large range. The `-sV` flag enables version detection, which is not strictly required but is commonly used in information gathering; however, the key factor for minimizing traffic and time is the `--top-ports` option, which uses a statistically derived list to reduce scan scope.

Answer

nmap -sS -p- target

Answer

nmap -sT -p 1-100 target

Answer

nmap -sC -p 1-1000 target

Question 8

A penetration tester is conducting passive reconnaissance on a target organization. Which technique can be used to discover subdomains of the target's domain without sending any packets to the target's network?

Accepted Answer

Using the 'site:' operator in a search engine query. Option B is correct because using the 'site:' operator in a search engine query (e.g., 'site:example.com') retrieves indexed subdomains from the search engine's cache without sending any packets to the target's network. This is a purely passive technique that leverages publicly available data, aligning with the definition of passive reconnaissance.

Answer

Performing a DNS brute-force attack against the target's domain

Answer

Sending ICMP echo requests to potential subdomain IP addresses

Answer

Querying WHOIS databases for domain registration information

Question 9

A penetration tester wants to quickly identify which of the top 100 common ports are open on a target system, while minimizing network traffic and scan time. Which Nmap command is most appropriate?

Accepted Answer

nmap -T5 -F target. Option B is correct because the `-T5` flag sets the fastest timing template (insane), which reduces delays and speeds up the scan, while the `-F` flag (fast mode) limits scanning to only the top 100 most common ports as defined in Nmap's nmap-services file. This combination minimizes network traffic and scan time while quickly identifying open ports among the top 100, aligning with the goal of efficiency.

Answer

nmap -p- target

Answer

nmap -sn target

Answer

nmap -sV target

Question 10

A penetration tester wants to passively gather information about a target's technology stack, including web server software and frameworks. Which resource is best suited for this task without sending any packets to the target?

Accepted Answer

BuiltWith. BuiltWith is a web-based reconnaissance tool that analyzes a target website's technology stack by examining publicly available data, such as HTTP headers, HTML source code, and JavaScript files, without sending any packets from the tester's machine. It passively gathers information about web server software, frameworks, analytics tools, and more, making it ideal for passive information gathering.

Answer

Shodan

Answer

Nmap with -sT scan

Answer

Wappalyzer browser extension

Question 11

A penetration tester is performing active reconnaissance on a target network. The tester wants to identify all live hosts in the 192.168.1.0/24 subnet and determine which ones have port 80 open. Which technique is most efficient for this task?

Accepted Answer

Use a ping sweep to identify live hosts, then run a SYN scan on port 80 for those hosts.. Option B is correct because it combines two efficient steps: first, a ping sweep (ICMP Echo Request or ARP scan) identifies live hosts in the 192.168.1.0/24 subnet, reducing the number of targets; second, a SYN scan on port 80 for only those live hosts is faster and less intrusive than scanning all ports or all IPs without prior host discovery. This approach minimizes network traffic and scan time while accurately identifying hosts with HTTP services.

Answer

Perform a full TCP connect scan on all 65535 ports for each IP address.

Answer

Run a SYN scan on port 80 for every IP in the subnet without ping probing.

Answer

Use ARP requests to map the subnet and then check for port 80 on each host.

Question 12

A penetration tester is using a vulnerability scanner to assess a web application. The scanner reports a 'SQL Injection' finding with a high confidence level. However, manual verification of the same payload does not trigger the vulnerability in a browser. Which of the following is the most likely reason for this discrepancy?

Accepted Answer

The scanner might have generated a false positive due to a misinterpretation of the server's response. The most likely reason is that the scanner generated a false positive due to a misinterpretation of the server's response. Vulnerability scanners often infer SQL injection based on response patterns (e.g., database error messages, timing differences) that may not actually be exploitable. Manual verification in a browser failed because the payload did not produce a true SQL error or data leak, confirming the scanner's alert was incorrect.

Answer

The scanner used a different HTTP method than the one used in manual testing

Answer

The scanner's payloads were URL-encoded differently

Answer

The vulnerability exists only in the scanner's simulated environment

Question 13

A penetration tester wants to discover subdomains of a target domain without sending any packets directly to the target's network. Which resource is most effective for this purpose?

Accepted Answer

Certificate Transparency logs. Certificate Transparency (CT) logs are publicly accessible, append-only ledgers that record every SSL/TLS certificate issued by a Certificate Authority (CA). Since certificates often include Subject Alternative Names (SANs) listing subdomains, querying CT logs (e.g., via crt.sh or tools like `certigo`) reveals subdomains without any direct network probes. This makes CT logs the most effective passive reconnaissance resource, as no packets are sent to the target's infrastructure.

Answer

DNS brute force with a wordlist

Answer

WHOIS lookup

Answer

Traceroute

Question 14

A penetration tester is performing internal reconnaissance. The tester discovers that the internal DNS server allows recursive queries from the tester's machine. Which technique can the tester use to enumerate internal hosts and network ranges?

Accepted Answer

Attempt a DNS zone transfer (AXFR). B is correct because a DNS zone transfer (AXFR) allows a client to request a complete copy of the DNS zone from a DNS server. If the server is misconfigured to allow recursive queries and does not restrict AXFR requests, the tester can enumerate all internal hostnames and IP addresses, effectively mapping the internal network ranges.

Answer

Perform DNS cache snooping

Answer

Query for all SRV records

Answer

Perform a reverse DNS sweep of the entire subnet

Question 15

A penetration tester is performing passive reconnaissance to discover email addresses associated with a target domain. The tester wants to avoid sending any packets directly to the target's infrastructure. Which tool is most appropriate for this task?

Accepted Answer

Using theHarvester to search public sources like search engines, PGP key servers, and social media. TheHarvester is designed specifically for passive reconnaissance, gathering email addresses, subdomains, and other data from public sources such as search engines, PGP key servers, and social media without sending any packets directly to the target's infrastructure. This aligns perfectly with the requirement to avoid direct interaction with the target domain.

Answer

Using the whois command to query domain registration details

Answer

Using Shodan to identify email servers and associated addresses

Answer

Using Google dorking with advanced search queries to find email addresses in indexed pages