PT0-002 Information Gathering and Vulnerability Scanning Practice Test 6 — 15 Questions

Question 1

A penetration tester is planning to perform a vulnerability scan of an internal network. Which of the following should be considered before scanning? (Choose three.)

Accepted Answer

Obtain written authorization from the client. Option A is correct because written authorization from the client is a legal and ethical prerequisite before any scanning activity. Without explicit permission, the penetration tester could be liable for unauthorized access under laws like the Computer Fraud and Abuse Act (CFAA) or similar regulations, as vulnerability scanning involves sending probes that may trigger intrusion detection systems or cause unintended disruptions.

Answer

Perform the scan during peak business hours

Answer

Test all available exploit modules

Question 2

Refer to the exhibit. A penetration tester has performed a basic Nmap scan and found an open MySQL service. Which of the following should the tester do NEXT to further investigate the MySQL service?

Accepted Answer

Run a version detection scan using -sV on port 3306. Option C is correct because the next logical step after discovering an open MySQL service (port 3306) is to perform version detection using `-sV` in Nmap. This identifies the exact MySQL version, which is critical for determining known vulnerabilities (CVEs) and appropriate exploitation techniques. Without version information, the tester cannot assess whether the service is outdated or misconfigured.

Answer

Perform a UDP scan on port 3306

Answer

Connect to the MySQL service using default credentials

Answer

Scan for other hosts with port 3306 open

Question 3

Refer to the exhibit. A penetration tester is reviewing a web server error log. Based on the log, what vulnerability does the tester suspect?

Accepted Answer

Hardcoded credentials. Option D is correct because the warning shows that a password is being used for database connection, and the message indicates hardcoded credentials (user 'test' with a password) are present in the code. Option A (XSS) is not evident. Option B (SQL injection) is not shown. Option C (remote code execution) is not indicated.

Answer

Cross-site scripting

Answer

SQL injection

Answer

Remote code execution

Question 4

Refer to the exhibit. A penetration tester finds this configuration file during an assessment. Which of the following is the most critical security concern with this configuration?

Accepted Answer

The use of LDAP instead of LDAPS. LDAP transmits credentials and queries in cleartext over TCP port 389, making it vulnerable to sniffing and credential theft. LDAPS (LDAP over SSL/TLS) encrypts the entire session on port 636, protecting the bind password and directory data in transit. Since the configuration uses LDAP instead of LDAPS, an attacker on the network can capture the bind password and potentially gain unauthorized access to the directory service.

Answer

The bind password is stored in plaintext

Answer

The server name is an internal hostname

Answer

The port is non-standard

Question 5

A penetration tester is tasked with performing passive reconnaissance against a client without triggering any alerts. Which of the following techniques would be MOST appropriate?

Accepted Answer

Shodan search. Shodan is a search engine that indexes banners from internet-facing devices, allowing a penetration tester to gather information about a client's exposed services (e.g., open ports, software versions) without sending any packets to the target. This makes it a purely passive technique that will not trigger any alerts on the client's network or intrusion detection systems.

Answer

Nmap SYN scan

Answer

Brute-force login

Answer

Netcat banner grab

Question 6

During an internal penetration test, a tester discovers that the client's network uses ARP poisoning to intercept traffic for security monitoring. The tester wants to enumerate live hosts without being detected by network monitoring tools. Which of the following is the BEST approach?

Accepted Answer

Use passive network sniffing to capture broadcast traffic. Option D is correct because passive network sniffing captures broadcast traffic without generating any packets, avoiding detection. Option A generates ARP traffic; Option B generates SYN packets; Option C generates UDP packets.

Answer

Perform a UDP scan

Answer

Perform a SYN scan with decoys

Answer

Use ARP requests to discover hosts

Question 7

A penetration tester is conducting vulnerability scanning on a web application that uses a Web Application Firewall (WAF). The scanner triggers a WAF block after several requests. Which of the following techniques would be MOST effective to continue scanning while evading the WAF?

Accepted Answer

Randomize request parameters and headers. Option C is correct because randomizing request parameters and headers makes it harder for the WAF to detect pattern-based scanning. Option A increases detection likelihood; Option B may not evade pattern detection; Option D is for port scanning, not web.

Answer

Increase scan speed

Answer

Use HTTP/2 multiplexing

Answer

Perform a full TCP connect scan

Question 8

Which of the following tools is primarily used for enumerating subdomains via search engine queries?

Accepted Answer

theHarvester. theHarvester is specifically designed to gather emails, subdomains, IPs, and URLs from public sources, including search engines like Google, Bing, and Yahoo. It leverages search engine APIs and scraping techniques to enumerate subdomains without directly interacting with the target infrastructure, making it the correct tool for this task.

Answer

Metasploit

Answer

Netcat

Answer

Nmap

Question 9

A tester is performing a vulnerability scan against a critical production server. The client requests minimal impact on system performance. Which scan type should the tester use?

Accepted Answer

Vulnerability scan with low-thread count. Option B is correct because a vulnerability scan with a low-thread count reduces the number of concurrent connections and packets sent to the target, minimizing CPU, memory, and network overhead on the production server. This directly addresses the client's requirement for minimal performance impact while still performing a legitimate security assessment. Unlike aggressive or stealth scans, this approach throttles the scan intensity to avoid service disruption.

Answer

TCP connect scan

Answer

Aggressive Nmap scan

Answer

Stealth SYN scan

Question 10

During a penetration test, a tester identifies that the target's network uses Private VLANs to isolate hosts. Which technique can be used to bypass this isolation and perform ARP spoofing?

Accepted Answer

VLAN hopping. Private VLANs isolate hosts within the same VLAN by restricting traffic at the switch level. VLAN hopping (option D) allows an attacker to bypass this isolation by exploiting the switch's trunking protocol (e.g., DTP) to negotiate a trunk link, enabling the attacker to send and receive frames on multiple VLANs, including the target's community or isolated VLAN, thus facilitating ARP spoofing across the Private VLAN boundaries.

Answer

ARP cache poisoning from the switch

Answer

MAC flooding

Answer

Double tagging

Question 11

A penetration tester needs to gather information about a target organization's employees and email addresses from public sources. Which passive reconnaissance tool is BEST suited for this task?

Accepted Answer

Maltego. Maltego is a passive reconnaissance tool that excels at gathering information from public sources, including employee names, email addresses, and organizational relationships, by querying open-source intelligence (OSINT) data such as social media, search engines, and DNS records. It uses transforms to automate data collection and link analysis, making it ideal for this task without directly interacting with the target's systems.

Answer

Nikto

Answer

Nmap

Answer

Wireshark

Question 12

A tester conducts a vulnerability scan and receives a high number of false positives. Which of the following is the BEST way to reduce false positives in subsequent scans?

Accepted Answer

Use a scan template specifically for the target OS. Option D is correct because using a scan template tailored to the target OS improves accuracy. Option A may increase false positives; Option B is aggressive; Option C increases timeouts but does not address false positives.

Answer

Credentialed scanning

Answer

Increase scan timeout values

Answer

Aggressive scanning

Question 13

A PenTest team is planning to perform a physical social engineering engagement to gather information from a client's facility. Which of the following reconnaissance techniques would be LEAST likely to be detected?

Accepted Answer

Dumpster diving. Option A is correct because dumpster diving is a physical, low-tech method that often goes unnoticed. Options B, C, and D involve direct interaction and have higher detection risk.

Answer

Shoulder surfing

Answer

Email phishing

Answer

Tailgating

Question 14

A penetration tester is performing information gathering for a web application. Which of the following are passive information gathering techniques? (Select THREE).

Accepted Answer

Source code review from public repositories. Options B, D, and E are correct because they involve querying public data without sending packets to the target. Option A can be active if performed directly; Option C is active scanning.

Answer

DNS zone transfer

Answer

Port scanning

Question 15

A penetration tester needs to perform initial reconnaissance on a target domain. Which of the following tools are specifically designed for domain enumeration? (Select TWO).

Accepted Answer

theHarvester. Options A and C are correct. TheHarvester and Recon-ng are purpose-built for domain enumeration. Metasploit is for exploitation; Netcat is a networking utility; Wireshark is for packet analysis.

Answer

Wireshark

Answer

Metasploit

Answer

Netcat