PT0-002 Reconnaissance and Enumeration — 20 Questions

Question 1

During a penetration test, you need to gather information about a target's email addresses and employee names without directly interacting with the target's systems. Which tool is most appropriate for this passive reconnaissance task?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

theHarvester. theHarvester is an OSINT tool designed to gather emails, subdomains, IPs, and employee names from public sources like search engines and social media. Maltego is more for relationship mapping, Shodan for internet-facing devices, and Censys for certificate and network data.

Answer

Shodan

Answer

Censys

Answer

Maltego

Question 2

You are performing a vulnerability scan on a web application and notice that the scanner reports a high-severity SQL injection vulnerability. However, manual testing confirms that the input is properly sanitized. Which term best describes this situation?

Accepted Answer

False positive. A false positive occurs when a scanner incorrectly identifies a vulnerability that does not exist. This is common in automated vulnerability scanning and requires manual verification.

Answer

False negative

Answer

True positive

Answer

Inconclusive

Question 3

Which Nmap scan type sends SYN packets to determine open ports without completing the TCP three-way handshake?

Accepted Answer

-sS. The SYN scan (-sS) sends a SYN packet and if a SYN/ACK is received, the port is considered open; it does not complete the handshake, making it stealthier than a full connect scan.

Answer

-sU

Answer

-sT

Answer

-sN

Question 4

You are conducting a penetration test and need to identify subdomains of a target domain using a passive approach that does not generate traffic to the target's servers. Which technique should you use?

Accepted Answer

Certificate transparency logs. Certificate transparency logs (e.g., crt.sh) are public logs of SSL/TLS certificates, often containing subdomain names. Querying them is passive and does not interact with the target.

Answer

DNS cache snooping

Answer

Subdomain bruteforce with gobuster

Answer

DNS zone transfer

Question 5

You are performing a network scan and need to identify live hosts on a subnet without triggering firewalls that block ICMP. Which technique should you use?

Accepted Answer

ARP scan with arp-scan. Using ARP scan (arp-scan) works on local networks and does not rely on ICMP, making it effective even when ICMP is blocked. It sends ARP requests and listens for replies.

Answer

Ping sweep with nmap -sn

Answer

TCP SYN ping with nmap -PS

Answer

UDP scan with nmap -sU

Question 6

During a penetration test, you find a web application that uses JavaScript to make API calls. You want to discover hidden API endpoints and potential secrets (e.g., API keys) embedded in the client-side code. Which approach is most appropriate?

Accepted Answer

Download and analyze the JavaScript files. JavaScript files in client-side web applications often contain hardcoded API endpoints, API keys, and other secrets that developers inadvertently leave in the source code. By downloading and analyzing these files (e.g., via browser developer tools or wget), you can discover hidden endpoints and sensitive tokens that are not exposed in the HTML or network traffic alone.

Answer

Perform a DNS zone transfer

Answer

Run a Nikto scan against the application

Answer

Use theHarvester to search for API endpoints

Question 7

In the context of OSINT, which resource would you use to find historical versions of a company's website that may reveal outdated information or hidden directories?

Accepted Answer

Wayback Machine. The Wayback Machine (archive.org) is the correct resource because it archives historical snapshots of websites, allowing you to view past versions that may contain outdated information, hidden directories, or old configurations no longer present on the live site. This is a core OSINT technique for discovering legacy content or forgotten endpoints.

Answer

crt.sh

Answer

Censys

Answer

Shodan

Question 8

You are performing a vulnerability scan on an internal network using an authenticated scanner. Which of the following is a primary benefit of authenticated scanning compared to unauthenticated scanning?

Accepted Answer

It provides more accurate identification of vulnerabilities that require credentials. Authenticated scanning provides deeper insight by checking for missing patches, misconfigurations, and vulnerabilities that require valid credentials to detect, such as local privilege escalation issues.

Answer

It eliminates false positives entirely

Answer

It reduces network traffic

Answer

It avoids detection by intrusion detection systems

Question 9

You are tasked with identifying the technologies used by a web application (e.g., web server, frameworks, libraries) during the reconnaissance phase. Which tool would you use?

Accepted Answer

WhatWeb. WhatWeb is a tool for fingerprinting web technologies. It identifies software, frameworks, and other components by analyzing HTTP responses and page content. Wappalyzer is a browser extension but WhatWeb is command-line and scriptable.

Answer

Gobuster

Answer

theHarvester

Answer

Nmap

Question 10

You are conducting passive reconnaissance on a target organization. Which of the following are examples of passive reconnaissance techniques? (Select TWO.)

Accepted Answer

Querying certificate transparency logs. Passive reconnaissance involves collecting information without directly interacting with the target's systems. WHOIS lookups and certificate transparency logs are passive. DNS zone transfer and port scanning are active. Social engineering is active.

Answer

DNS zone transfer

Answer

Scanning ports with Nmap

Answer

Sending phishing emails

Question 11

During a penetration test, you need to enumerate SNMP information from network devices. Which of the following tools or commands can be used for SNMP enumeration? (Select TWO.)

Accepted Answer

snmpwalk. snmpwalk is a classic tool to walk through the SNMP MIB tree. onesixtyone is a tool for brute-forcing SNMP community strings. nmap can also be used with scripts, but snmp-check is a specific tool. snmpwalk and onesixtyone are direct SNMP enumeration tools.

Answer

nmap -sU

Answer

curl

Answer

snmp-check

Question 12

You are performing reconnaissance on a target's web application. Which of the following techniques can be used to discover hidden directories and files? (Select THREE.)

Accepted Answer

Using feroxbuster. Directory bruteforce tools like dirsearch, gobuster, and feroxbuster are designed to discover hidden directories and files by using wordlists. Nikto is a vulnerability scanner, not primarily for directory discovery. theHarvester is for email/subdomain harvesting.

Answer

Running Nikto with default options

Answer

Querying theHarvester

Question 13

During the information gathering phase, a penetration tester wants to discover subdomains of a target domain using DNS queries and potentially brute-forcing common subdomain names. Which of the following tools is specifically designed for subdomain enumeration and can perform both passive and active techniques?

Accepted Answer

Amass. Amass is a tool that performs subdomain enumeration using passive sources and active brute-forcing. Gobuster and dirsearch are for directory/file enumeration. Nmap is for port scanning.

Answer

Nmap

Answer

dirsearch

Answer

Gobuster

Question 14

A penetration tester is conducting active reconnaissance on a target network and wants to perform a SYN scan to identify open ports without completing the full TCP handshake. Which Nmap flag should the tester use?

Accepted Answer

-sS. The -sS flag specifies a SYN scan, which is stealthy and does not complete the three-way handshake.

Answer

-sA

Answer

-sU

Answer

-sT

Question 15

After gaining initial access to an internal network, a penetration tester wants to identify live hosts on a subnet without generating excessive traffic. Which Nmap command would be most appropriate for host discovery using ICMP echo requests and TCP SYN to port 80?

Accepted Answer

nmap -sn 192.168.1.0/24. Nmap's -sn flag performs a ping sweep, which by default uses ICMP echo, TCP SYN to port 80, and other probes. The other options are for port scanning or OS detection.

Answer

nmap -A 192.168.1.0/24

Answer

nmap -sS 192.168.1.0/24

Answer

nmap -O 192.168.1.0/24

Question 16

A penetration tester is performing web application reconnaissance and wants to discover API endpoints and hidden parameters that may not be linked from the main application. Which technique would be most effective for this purpose?

Accepted Answer

JavaScript analysis for endpoint discovery. JavaScript analysis often reveals AJAX API endpoints, keys, and parameters that are not visible in HTML. Directory bruteforcing may find endpoints but JS analysis is more targeted for hidden APIs.

Answer

Running Nikto for web server vulnerabilities

Answer

Directory bruteforcing with gobuster

Answer

Using Wappalyzer to fingerprint technologies

Question 17

A penetration tester is performing a vulnerability scan on a web server using Nikto. After the scan, the tester notices several findings related to outdated software versions and missing security headers. What should the tester do to validate the findings and reduce false positives?

Accepted Answer

Manually verify a subset of the findings. Manually verifying findings is the best practice to confirm if they are real vulnerabilities or false positives. Relying on scanner output alone is insufficient.

Answer

Ignore findings related to missing headers as low priority

Answer

Increase the scan intensity to get more details

Answer

Accept all findings as true since Nikto is a reliable tool

Question 18

During a penetration test, the tester wants to gather information about a target using publicly available DNS records, including mail servers, name servers, and possibly TXT records. Which type of DNS query would be most useful for obtaining a comprehensive list of these records?

Accepted Answer

AXFR zone transfer request. An AXFR (zone transfer) request is the correct choice because it retrieves the entire DNS zone file from a name server, which includes all record types (A, AAAA, MX, NS, TXT, etc.) for a domain. This provides a comprehensive list of publicly available DNS records, making it ideal for information gathering during a penetration test. In contrast, specific queries like NS or MX only return a single record type, limiting the scope of enumeration.

Answer

NS record query

Answer

MX record query

Answer

A record query

Question 19

A penetration tester is using Shodan to identify internet-facing devices associated with a target organization. Which of the following is Shodan's primary function in the context of passive reconnaissance?

Accepted Answer

Searching for devices and services exposed to the internet. Shodan is a search engine for internet-connected devices, providing information about services and banners. It does not perform active scans itself; it indexes data from active scanning.

Answer

Analyzing malware samples

Answer

Exploiting vulnerabilities in IoT devices

Answer

Performing live port scans on target IPs

Question 20

A penetration tester is conducting a web application assessment and discovers that the target uses WordPress. The tester wants to identify installed plugins, themes, and potential vulnerabilities. Which of the following tools is best suited for this task?

Accepted Answer

WPScan. WPScan is a dedicated WordPress security scanner that enumerates installed plugins, themes, and known vulnerabilities by querying the WordPress API and fingerprinting version-specific files. It is purpose-built for WordPress assessments, making it the best choice for this task.

Answer

OpenVAS

Answer

Nikto

Answer

Gobuster