PT0-002 Information Gathering and Vulnerability Scanning Practice Test 4 — 15 Questions

Question 1

A penetration tester wants to identify the web server software and version used by a target organization without sending any packets to the target's infrastructure. Which of the following techniques is most effective for this purpose?

Accepted Answer

Use Shodan to search for the target's IP address or domain and review the gathered banners.. Shodan is a search engine that continuously scans the internet and stores service banners from various ports. By querying the target's IP address or domain, the penetration tester can retrieve previously collected HTTP headers and other service banners without sending any packets to the target, thus achieving passive reconnaissance.

Answer

Perform a DNS zone transfer to obtain internal server information.

Answer

Use netcat to connect to port 80 and read the HTTP banner.

Answer

Use nmap -sV with a delayed scan to avoid detection.

Question 2

A penetration tester wants to identify all publicly accessible Amazon S3 buckets that belong to a specific organization. Which technique is most effective for passive reconnaissance?

Accepted Answer

Use Google dorks to search for bucket names and URLs.. Google dorks (e.g., site:s3.amazonaws.com "companyname") allow a penetration tester to passively discover publicly accessible S3 bucket names and URLs indexed by search engines without sending any traffic to the target organization. This technique leverages existing search engine caches, making it purely passive and highly effective for identifying misconfigured buckets that have been crawled.

Answer

Send DNS queries for common bucket name prefixes.

Answer

Use nmap to scan all AWS IP ranges for open ports.

Answer

Perform a DNS zone transfer on the target organization's domain.

Question 3

A penetration tester is performing internal reconnaissance from a compromised host and wants to map the local network without sending any packets. Which technique is most suitable?

Accepted Answer

Use tcpdump to passively capture and analyze broadcast traffic.. Option A is correct because tcpdump can passively capture broadcast traffic (e.g., ARP, NetBIOS, mDNS) without sending any packets. This allows the tester to map active hosts and services on the local network by listening to existing network chatter, fulfilling the 'no packets sent' constraint.

Answer

Send ARP requests to all possible IP addresses using a ping sweep.

Answer

Query the local DNS server for all host records in the domain.

Answer

Use traceroute to discover network paths.

Question 4

A penetration tester is performing active reconnaissance on a target network. The tester sends TCP SYN packets to a range of ports on a target host. Only a few ports respond with SYN-ACK packets. What does this indicate?

Accepted Answer

The ports that responded with SYN-ACK are open.. The TCP three-way handshake begins with a SYN packet; a SYN-ACK response indicates that the target port received the SYN and is willing to establish a connection, meaning the port is open and listening. Only ports that respond with SYN-ACK are confirmed open, while others may be closed or filtered, but the presence of any SYN-ACK replies directly indicates open ports.

Answer

The host is protected by a firewall that drops all packets.

Answer

The host is running a stealthy IDS.

Answer

The network is using IPv6.

Question 5

A penetration tester wants to identify the operating system of a remote host without sending any traffic to the target network. Which of the following techniques is most effective for this purpose?

Accepted Answer

Use Shodan to search for the host's IP address and examine the service banners.. Option B is correct because Shodan is a search engine that indexes service banners and metadata from internet-connected devices. By querying Shodan for the target's IP address, the tester can retrieve previously collected OS information without sending any packets to the target, satisfying the 'no traffic' constraint.

Answer

Perform an nmap OS fingerprint scan on the host.

Answer

Send a ping sweep to the host's network segment.

Answer

Use ARP scanning to discover the host's MAC address and look up the vendor.

Question 6

A penetration tester is performing a vulnerability scan on a target network. The tester uses Nmap with the default NSE scripts against a web server. The scan report shows several 'http-vuln-cve2017-5638' findings. What does this indicate?

Accepted Answer

The target is vulnerable to Apache Struts2 remote code execution. The Nmap script 'http-vuln-cve2017-5638' specifically targets the Apache Struts2 remote code execution vulnerability (CVE-2017-5638). This vulnerability exists in the Jakarta Multipart parser used by Apache Struts2, allowing an attacker to execute arbitrary commands via crafted Content-Type headers. The presence of this finding in the scan report indicates the web server is running a vulnerable version of Apache Struts2.

Answer

The target is vulnerable to the Heartbleed bug in OpenSSL

Answer

The target is vulnerable to the Shellshock Bash vulnerability

Answer

The target has a SQL injection vulnerability

Question 7

A penetration tester is tasked with performing vulnerability scanning on a target organization that uses a web application firewall (WAF) and an intrusion prevention system (IPS). The tester wants to avoid being blocked while still gathering comprehensive data. Which scanning approach is most effective?

Accepted Answer

Use a slow, distributed scan from multiple IP addresses with random delays. A slow, distributed scan from multiple IP addresses with random delays is most effective because it evades rate-based detection mechanisms in WAFs and IPSs. By spreading the scan across many sources and introducing jitter, the traffic appears as normal user activity rather than a coordinated attack, allowing comprehensive data collection without triggering blocks.

Answer

Perform an aggressive scan with a high thread count to complete before the WAF adapts

Answer

Only perform passive reconnaissance and avoid active scanning

Answer

Use known WAF bypass techniques for each request

Question 8

A penetration tester wants to identify all subdomains for a target domain using only public records. Which technique is most effective for this purpose?

Accepted Answer

Searching crt.sh (Certificate Transparency logs).. Certificate Transparency logs, accessible via crt.sh, are a public record of all SSL/TLS certificates issued for a domain. Since certificates often include Subject Alternative Names (SANs) listing subdomains, querying crt.sh reveals subdomains without any interaction with the target's infrastructure. This technique is passive, requires no authorization, and leverages mandatory logging per RFC 6962, making it highly effective for enumeration from public records.

Answer

DNS zone transfer.

Answer

Using Nmap to brute-force subdomains.

Answer

Querying the domain's MX records.

Question 9

A penetration tester is using theHarvester tool to gather email addresses and subdomains for a target domain. Which source is theHarvester commonly configured to use for passive reconnaissance?

Accepted Answer

Google search. TheHarvester is a passive reconnaissance tool that collects emails, subdomains, and other data from public sources without directly interacting with the target. Google search is a primary source because theHarvester uses Google's search engine via its API or scraping to find indexed pages containing email addresses and subdomains, leveraging Google's dorking capabilities for passive data gathering.

Answer

Shodan

Answer

DNS zone transfer

Answer

Social media APIs

Question 10

A penetration tester is performing a vulnerability scan on a web server that uses HTTPS. The tester wants to identify the server's SSL/TLS configuration weaknesses without overwhelming the server. Which Nmap command is most appropriate?

Accepted Answer

nmap -sV --script ssl-enum-ciphers -p 443 target. Option A is correct because the `ssl-enum-ciphers` NSE script enumerates all supported SSL/TLS ciphers and protocols on the target, providing a detailed assessment of cryptographic weaknesses (e.g., weak ciphers, outdated TLS versions). The `-sV` flag enables version detection, and `-p 443` targets the HTTPS port, while the script itself is designed to be lightweight and not overwhelm the server, making it ideal for a non-intrusive vulnerability scan.

Answer

nmap -sT -A -T4 -p 443 target

Answer

nmap -sU -p 443 target

Answer

nmap -sC -p 443 target

Question 11

A penetration tester is performing passive reconnaissance on a target organization. The tester wants to gather information about the target's technology stack, including web server software and frameworks, without directly interacting with the target systems. Which technique is most effective?

Accepted Answer

Querying public records with BuiltWith. BuiltWith is a passive reconnaissance tool that queries public web data and DNS records to identify a target's technology stack, such as web server software (e.g., Apache, Nginx) and frameworks (e.g., React, Django), without sending any packets to the target's systems. This makes it ideal for passive information gathering, as it relies on third-party databases and cached information rather than direct interaction.

Answer

Running Nmap with the -A flag against the target's public IP range

Answer

Using theHarvester to search for email addresses and subdomains

Answer

Performing a DNS zone transfer

Question 12

A penetration tester is using theHarvester tool to gather information about a target domain. The tester wants to collect email addresses and subdomains from public search engines and PGP key servers. Which source is theHarvester commonly configured to use for this passive reconnaissance?

Accepted Answer

Google and Bing search engines. Option D is correct because theHarvester is specifically designed to perform passive reconnaissance by querying public search engines (like Google and Bing) and PGP key servers to collect email addresses, subdomains, and other open-source intelligence (OSINT). It does not initiate direct connections to the target's infrastructure, making it a passive tool. The default configuration often includes Google and Bing as primary sources for this data.

Answer

Direct DNS zone transfer

Answer

Shodan

Answer

Baidu

Question 13

A penetration tester has been given access to a network tap on a client's internal network. The tester wants to perform initial reconnaissance by identifying all live hosts and their operating systems without sending any packets that could be detected. Which technique is most appropriate?

Accepted Answer

Run Wireshark to capture traffic and analyze source IP addresses and TCP/IP stack signatures.. Option B is correct because capturing traffic with Wireshark from a network tap is entirely passive—it never injects packets into the network. By analyzing source IP addresses and TCP/IP stack signatures (e.g., TTL values, window sizes, and IP ID patterns), the tester can identify live hosts and infer their operating systems without sending any detectable traffic. This aligns perfectly with the requirement to avoid sending any packets.

Answer

Perform an ARP scan using arp-scan from a connected workstation.

Answer

Use Nmap with the -sn flag to perform a ping sweep of the subnet.

Answer

Initiate a DNS zone transfer request to the internal DNS servers.

Question 14

A vulnerability scanner reports an unauthenticated critical finding on an internal server. Manual testing shows the vulnerable package is present, but the vulnerable service is disabled and not reachable. How should the tester report this?

Accepted Answer

Report the finding with contextual risk adjustment and explain that the vulnerable service is disabled and not reachable.. Option A is correct because the vulnerability scanner identified a real package vulnerability, but manual verification revealed the service is disabled and unreachable. The tester must report the finding with a contextual risk adjustment to accurately reflect the reduced exploitability, as per standard risk assessment practices in penetration testing. This ensures the organization understands the actual risk without ignoring the presence of the vulnerable package, which could be enabled in the future.

Answer

Delete the finding because the package exists but is not currently exploitable.

Answer

Report it as critical without context because the scanner assigned critical severity.

Answer

Exploit the service by enabling it first.

Question 15

A penetration tester is performing passive reconnaissance on a target organization. Which of the following activities would be considered passive reconnaissance?

Accepted Answer

Using a search engine to find exposed documents. Passive reconnaissance involves gathering information without directly interacting with the target's systems. Using a search engine to find exposed documents (e.g., via Google dorking) relies on publicly indexed data, which does not send any packets to the target's infrastructure. This aligns with the definition of passive reconnaissance as it leverages third-party sources rather than engaging the target directly.

Answer

Scanning open ports on the target web server

Answer

Sending a crafted ICMP echo request to the target

Answer

Attempting a SQL injection on a login form