PT0-002 Information Gathering and Vulnerability Scanning Practice Test 3 — 15 Questions

Question 1

A penetration tester runs a vulnerability scanner against a web server and receives a high-confidence alert that the server is vulnerable to Heartbleed (CVE-2014-0160). The tester manually verifies using an OpenSSL command and finds that the server is patched. Which of the following is the most likely cause of this false positive?

Accepted Answer

The scanner's vulnerability signatures are outdated and still flagging the old behavior. Option A is correct because outdated vulnerability signatures are the most common cause of false positives in vulnerability scanning. The scanner's signature database likely still contains the original detection logic for Heartbleed (e.g., checking for a specific TLS heartbeat response length or pattern), which the patched server no longer exhibits. When the tester manually verified with an OpenSSL command (e.g., `openssl s_client -connect target:443 -tlsextdebug`), the patched server correctly handled the heartbeat request, confirming the scanner's alert was based on stale signatures.

Answer

The scanner's plugin for Heartbleed was misconfigured and sent malformed packets

Answer

The server returned a generic error message that the scanner misinterpreted as a sign of the vulnerability

Answer

The scanner's network connection was intermittent, causing incomplete responses that were incorrectly flagged

Question 2

A penetration tester wants to identify hosts on a network that are running web servers on any TCP port, including non-standard ports. Which Nmap command is most efficient for this task?

Accepted Answer

nmap -sV -p- target. Option A is correct because `-sV` enables version detection to identify web server software, and `-p-` scans all 65535 TCP ports, including non-standard ones. This combination efficiently discovers web servers on any port without unnecessary overhead like OS detection or default script scanning.

Answer

nmap -sC -p 80,443 target

Answer

nmap -O -p- target

Answer

nmap -sT -p 8000,8080 target

Question 3

A penetration tester has compromised a Windows domain-joined workstation and needs to identify all domain controllers and their IP addresses without triggering detection mechanisms. Which technique is most likely to avoid raising alerts?

Accepted Answer

Perform an LDAP query using ADSI to enumerate domain controllers. Performing an LDAP query using ADSI to enumerate domain controllers is stealthy because it uses standard, authenticated Windows API calls that blend into normal domain traffic. This technique queries the directory service for the 'domainController' object class, which returns the DNS hostnames and IP addresses without generating suspicious network scans or DNS anomalies.

Answer

Attempt a DNS zone transfer from the internal DNS server

Answer

Perform an ARP scan of the subnet to identify active IP addresses

Answer

Use Nmap to perform a SYN scan of the entire subnet looking for Kerberos service ports

Question 4

A penetration tester is analyzing the results of a vulnerability scan against a web application. The scanner reports a potential SQL injection vulnerability in a login form parameter. However, manual testing with the same payload does not produce any error messages or changes in behavior. Which of the following is the most likely reason for the false positive?

Accepted Answer

The web application is using a parameterized query that sanitizes input. Option B is correct because the use of parameterized queries (prepared statements) separates SQL logic from user input, preventing SQL injection even if the input contains malicious payloads. The scanner's payload triggered a false positive because the application's database layer safely handles the input, so no error or behavioral change occurs during manual testing.

Answer

The scanner used a payload that was not URL-encoded

Answer

The scanning engine is outdated and does not support the latest SQL syntax

Answer

The login form is protected by a CAPTCHA that blocks automated scanning

Question 5

A penetration tester is performing internal reconnaissance on a Windows Active Directory environment. The tester has a low-privileged domain user account. Which of the following techniques is most likely to help identify all domain controllers and their IP addresses without generating excessive network traffic or alerts?

Accepted Answer

Query the DNS service for SRV records of _ldap._tcp.dc._msdcs.domain.local. Option B is correct because querying DNS for SRV records of _ldap._tcp.dc._msdcs.domain.local is a standard, low-noise method to discover all domain controllers in an Active Directory environment. This query leverages the automatic registration of LDAP service records by domain controllers, requiring only a single DNS lookup rather than sweeping the network, thus avoiding excessive traffic and typical security alerts.

Answer

Perform a full subnet ping sweep using Nmap

Answer

Use NetBIOS name resolution by sending broadcasts

Answer

Enumerate SMB shares on all IP addresses in the subnet

Question 6

A penetration tester is conducting passive reconnaissance on a target organization. The tester wants to identify all publicly accessible cloud storage buckets that might belong to the target without directly interacting with the target's infrastructure. Which of the following techniques would be most effective for this purpose?

Accepted Answer

Search for exposed cloud storage buckets using search engine dorks (e.g., 'site:s3.amazonaws.com target-company'). Option B is correct because search engine dorks allow a penetration tester to query publicly indexed content on cloud storage platforms like AWS S3 without sending any traffic to the target's infrastructure. By using a dork such as 'site:s3.amazonaws.com target-company', the tester leverages the search engine's pre-cached index to identify buckets that may be misconfigured or publicly accessible, which aligns perfectly with passive reconnaissance requirements.

Answer

Perform DNS enumeration using tools like `dnsrecon` to discover subdomains pointing to cloud storage services

Answer

Query certificate transparency logs to find SSL certificates issued to the target's cloud storage endpoints

Answer

Perform a WHOIS lookup to find IP ranges owned by the target and then scan those ranges for open storage services

Question 7

A penetration tester is performing internal reconnaissance on a network that uses IPv6. The tester wants to discover alive hosts and their IPv6 addresses without sending many packets. Which technique is most effective for this purpose?

Accepted Answer

Ping the IPv6 all-nodes multicast address (ff02::1) and analyze the responses to discover active hosts. Option B is correct because sending a ping to the IPv6 all-nodes multicast address (ff02::1) triggers a response from all active hosts on the local link that have IPv6 enabled, allowing the tester to discover alive hosts and their IPv6 addresses with minimal packets. This technique leverages the inherent multicast behavior of IPv6, where hosts join the all-nodes multicast group by default, making it highly efficient for reconnaissance without scanning each address individually.

Answer

Perform a full TCP SYN scan on the entire /64 subnet using Nmap with IPv6 addressing

Answer

Request the DHCPv6 server log from the network administrator to obtain a list of assigned IPv6 addresses

Answer

Use the `ip neighbor` command on the tester's machine to view the IPv6 neighbor cache after generating traffic

Question 8

A penetration tester is conducting a vulnerability scan of a web application that uses a custom API framework. The scanner reports several potential SQL injection vulnerabilities, but manual testing confirms they are false positives. The tester suspects the scanner is misinterpreting input validation. Which of the following is the most likely reason for these false positives?

Accepted Answer

The application reflects the injected payload in error messages or response content, causing the scanner to think the injection succeeded. Option B is correct because the scanner likely detected the injected payload reflected in the application's response (e.g., in an error message or echoed input), which it interpreted as successful SQL execution. In custom API frameworks, input validation may reject the payload but still reflect it back in the response, causing the scanner to flag a false positive. Manual testing confirms the injection fails, so the reflection is merely a side effect of the API's error handling, not a sign of database interaction.

Answer

The scanner used a payload that was blocked by a Web Application Firewall (WAF) before reaching the application

Answer

The scanner used outdated signatures that do not match the custom API's input validation logic

Answer

The application returns a generic 'Invalid input' message for all types of invalid input, confusing the scanner

Question 9

A penetration tester wants to perform DNS brute-force enumeration to discover subdomains of a target domain. Which tool is specifically designed for this purpose?

Accepted Answer

dnsrecon. B is correct because dnsrecon is a specialized DNS enumeration tool that includes a brute-force mode for discovering subdomains. It uses a wordlist to query DNS servers for common subdomain names, leveraging the DNS protocol's inherent structure to map out a target's domain hierarchy without relying on zone transfers.

Answer

nmap

Answer

Wireshark

Answer

Hydra

Question 10

A penetration tester is conducting an internal network scan and wants to minimize the chance of being detected by an intrusion detection system (IDS). Which TCP scan type is most likely to evade detection?

Accepted Answer

FIN scan. A FIN scan sends a TCP packet with only the FIN flag set, which is less likely to trigger IDS signatures that are tuned to detect common SYN-based scans. Many IDS systems monitor for SYN packets as they initiate connections, but a FIN scan exploits the fact that closed ports respond with an RST packet, while open ports ignore the FIN (per RFC 793), allowing the tester to infer port state without completing a full handshake.

Answer

TCP connect scan

Answer

SYN scan

Answer

UDP scan

Question 11

A penetration tester is performing passive reconnaissance on a target organization. The tester wants to identify internal IP address ranges used by the organization without interacting directly with their network. Which of the following techniques would be most effective for this purpose?

Accepted Answer

Querying public BGP route databases and looking up the organization's autonomous system (AS) number. Querying public BGP route databases (e.g., RADB, ARIN) using the organization's AS number allows a tester to retrieve IP prefixes announced by the target. This is passive reconnaissance because it uses publicly available routing data without sending any packets to the target's network, making it ideal for identifying internal IP ranges from an external perspective.

Answer

Performing a DNS zone transfer against the target's authoritative DNS servers

Answer

Using Shodan to search for devices from the target organization

Answer

Sending ARP requests on the local network segment to discover hosts

Question 12

During a reconnaissance phase, a penetration tester is using a tool to enumerate NetBIOS names on a target internal network. The tester issues the command 'nbtstat -A 192.168.1.100' on a Windows machine. What type of information is the tester most likely trying to obtain?

Accepted Answer

The NetBIOS name table including computer name, logged-in users, and domain. The `nbtstat -A` command queries the NetBIOS name table of a remote system using its IP address. This table contains the computer name, logged-in users, and domain/workgroup information, which are critical for identifying targets and potential trust relationships during internal reconnaissance.

Answer

The operating system version and patch level

Answer

A list of currently open TCP ports on the remote system

Answer

The MAC address of the remote network interface

Question 13

A penetration tester wants to discover all subdomains of a target domain without directly querying the target's DNS servers to avoid detection. Which technique is most appropriate?

Accepted Answer

Passive DNS enumeration using public data sources. Passive DNS enumeration leverages public data sources such as certificate transparency logs, search engine caches, and passive DNS databases (e.g., VirusTotal, SecurityTrails) to discover subdomains without sending any queries to the target's authoritative DNS servers. This approach avoids generating DNS traffic that could be logged or detected by the target's monitoring systems, making it ideal for stealthy reconnaissance.

Answer

DNS zone transfer

Answer

Brute-force subdomain enumeration using a wordlist

Answer

SNMP community string enumeration

Question 14

During an internal penetration test, a tester is trying to identify live hosts on a network segment. The tester wants to avoid generating a high volume of traffic or alerts. Which scanning technique is most appropriate for this task?

Accepted Answer

ARP ping scan. An ARP ping scan (option D) is the most appropriate technique because it operates at Layer 2 (Data Link layer) using ARP requests to determine if an IP address is active on the local subnet. Since ARP traffic is confined to the local broadcast domain and does not generate IP-level packets, it produces minimal network traffic and is unlikely to trigger IDS/IPS alerts, making it ideal for stealthy host discovery on a local network segment.

Answer

Full TCP connect scan on common ports

Answer

ICMP echo request sweep

Answer

SYN stealth scan on port 80 and 443

Question 15

A penetration tester is conducting passive reconnaissance on a target organization using Google dorking. The tester wants to find PDF documents that may contain usernames and passwords. Which Google search query is most appropriate for this task?

Accepted Answer

site:target.com filetype:pdf password. Option A is correct because it uses the `filetype:pdf` operator to specifically target PDF documents, combined with the keyword `password` to find files likely containing credentials. Google dorking with `site:target.com` restricts results to the target domain, making this query efficient for passive reconnaissance of exposed sensitive information in PDFs.

Answer

site:target.com username password

Answer

site:target.com filetype:xls password

Answer

site:target.com intitle:'index of' password