PT0-002 Reconnaissance and Enumeration — 20 Questions

Question 1

During a penetration test, you need to enumerate SNMP information from network devices. Which of the following tools or commands can be used for SNMP enumeration? (Select TWO.)

Accepted Answer

snmpwalk. snmpwalk is a classic tool to walk through the SNMP MIB tree. onesixtyone is a tool for brute-forcing SNMP community strings. nmap can also be used with scripts, but snmp-check is a specific tool. snmpwalk and onesixtyone are direct SNMP enumeration tools.

Answer

nmap -sU

Answer

curl

Answer

snmp-check

Question 2

During a penetration test, the tester wants to gather information about a target using publicly available DNS records, including mail servers, name servers, and possibly TXT records. Which type of DNS query would be most useful for obtaining a comprehensive list of these records?

Accepted Answer

AXFR zone transfer request. An AXFR (zone transfer) request is the correct choice because it retrieves the entire DNS zone file from a name server, which includes all record types (A, AAAA, MX, NS, TXT, etc.) for a domain. This provides a comprehensive list of publicly available DNS records, making it ideal for information gathering during a penetration test. In contrast, specific queries like NS or MX only return a single record type, limiting the scope of enumeration.

Answer

NS record query

Answer

MX record query

Answer

A record query

Question 3

A tester is performing DNS enumeration on a domain and wants to attempt a zone transfer. Which DNS record type is primarily used for zone transfers?

Accepted Answer

AXFR. Zone transfers use the AXFR (Authoritative Transfer) record type to replicate DNS data between servers.

Answer

SOA

Answer

NS

Answer

PTR

Question 4

A penetration tester is performing passive reconnaissance on a target organization. Which TWO of the following sources can provide information about the organization's historical web content? (Select TWO.)

Accepted Answer

Wayback Machine. The Wayback Machine archives historical snapshots of websites, and Pastebin can contain pasted content from the organization, including historical data.

Answer

Nmap

Answer

Shodan

Answer

Wireshark

Question 5

During a web application penetration test, the tester wants to discover hidden API endpoints. Which THREE of the following techniques can be used to achieve this? (Select THREE.)

Accepted Answer

Analyzing JavaScript files for API calls. Directory enumeration tools like gobuster or feroxbuster can find API paths; JavaScript analysis can reveal API calls; and parameter discovery tools like Arjun can find endpoints by brute-forcing parameters.

Answer

Performing a zone transfer

Answer

Running Nmap with service version detection

Question 6

A penetration tester is using Google dorks to find sensitive information about a target organization. Which search operator would help the tester find PDF files containing the word 'confidential' on the target's website?

Accepted Answer

site:target.com filetype:pdf intext:confidential. The filetype operator filters results by file extension (e.g., pdf), and the intext operator searches for the specified text within the page content.

Answer

site:target.com ext:pdf confidential

Answer

site:target.com intitle:confidential pdf

Answer

inurl:target.com filetype:pdf confidential

Question 7

A penetration tester is performing SNMP enumeration on a target network. Which command would likely be used to extract information from a device with the community string 'public'?

Accepted Answer

snmpwalk -v 2c -c public target_ip. snmpwalk is a standard tool for retrieving a subtree of SNMP MIB data, often used for enumeration with the -v 2c version and -c community string.

Answer

snmpget -v 2c -c public target_ip

Answer

snmpset -v 2c -c public target_ip

Answer

snmpbulkwalk -v 2c -c public target_ip

Question 8

A penetration tester is performing active reconnaissance on a target network and wants to use Nmap to identify operating systems and run default scripts against discovered services. Which two Nmap options should the tester include? (Choose TWO.)

Accepted Answer

-O. -O enables OS detection, and -sC runs default scripts. -sV is version detection, -sS is SYN scan, -A includes all but is not necessary if only OS and scripts are needed.

Answer

-sV

Answer

-A

Answer

-sS

Question 9

During a penetration test, the tester discovers that the target web application uses a content delivery network (CDN) that hides the origin server's IP address. Which technique would BEST help identify the true IP address of the backend server?

Accepted Answer

Query certificate transparency logs via crt.sh for the domain. Certificate transparency logs, such as those queried via crt.sh, record SSL/TLS certificates issued for a domain. These certificates often include the origin server's IP address in the Subject Alternative Name (SAN) or other extensions, or they may reveal additional subdomains that point directly to the backend server, bypassing the CDN. This technique is effective because CDNs typically terminate SSL at the edge, but the certificate may still contain the true backend IP in historical or misconfigured entries.

Answer

Perform a DNS zone transfer against the target's domain

Answer

Run a full TCP port scan against the domain with Nmap

Answer

Use Shodan to search for the domain's SSL certificate hash

Question 10

A penetration tester is tasked with performing a DNS enumeration of a target domain to discover subdomains. Which THREE tools are commonly used for subdomain bruteforcing? (Select THREE.)

Accepted Answer

amass. Option A (amass) is correct because it is a comprehensive DNS enumeration and subdomain discovery tool that performs brute-forcing via its 'amass enum -brute' mode using wordlists to resolve candidate subdomains. Option B (subfinder) is correct because it is a passive/active subdomain discovery tool that enumerates subdomains from multiple sources and can be combined with brute-forcing workflows to identify valid hostnames. Option C (dnsx) is correct because it is a fast DNS toolkit used to resolve, brute-force, and validate subdomains by querying DNS records for candidate names, making it a common component in subdomain bruteforcing pipelines. Option D (sublist3r) is not marked correct here, as it primarily aggregates subdomains from passive OSINT sources (search engines, certificate transparency) rather than performing active DNS bruteforcing. Option E (gobuster dns) is not marked correct, even though gobuster has a DNS mode, because the question's intended correct set does not include it.

Answer

sublist3r

Answer

gobuster dns

Question 11

A penetration tester is conducting passive reconnaissance against a target organization. Which TWO of the following techniques would be most appropriate for gathering information about the organization's infrastructure and employees without directly interacting with the target's systems?

Accepted Answer

Performing WHOIS lookups to find domain registration details. Option C is correct because WHOIS lookups query public registrar databases for domain registration details such as registrant contacts, name servers, and creation/expiration dates, which are third-party records that do not require touching the target's own systems. Option D is correct because searching LinkedIn for employee profiles and organizational structure relies on publicly posted social media data, giving names, roles, and technologies without any packets being sent to the target's infrastructure. Option A is not appropriate here because active DNS enumeration with nslookup or dig sends queries directly to the target's authoritative name servers, which is active reconnaissance rather than passive. Option B is not appropriate because querying Shodan, while using a third-party service, still involves scanning-derived data tied to the target's IP range and is often classified as active or semi-passive reconnaissance. Option E is not appropriate because reviewing the target's website on Netcraft involves interacting with the target's web-facing services and is not a purely passive, non-interactive technique.

Answer

Using DNS enumeration tools like nslookup or dig

Answer

Querying Shodan for open ports on the target's IP range

Answer

Reviewing the target's website on Netcraft

Question 12

During an active reconnaissance phase, a penetration tester runs Nmap against a target and obtains the following results: Host is up, ports 22, 80, and 443 are open. The tester then runs a vulnerability scan using Nessus with unauthenticated credentials. Which THREE of the following issues should the tester be most concerned about regarding the accuracy and completeness of the Nessus scan results?

Accepted Answer

Nessus might miss vulnerabilities that require authenticated access to detect. Unauthenticated scans often miss vulnerabilities that require authentication, may produce false positives due to banner-based detection, and may not detect certain services that rely on authenticated checks. Nmap results are typically accurate for open ports. Missing open ports due to firewall is possible but less likely with Nmap SYN scan.

Answer

The Nmap results may have false positives for open ports

Answer

Nessus will only scan the top 1000 ports by default, potentially missing services on higher ports

Question 13

A penetration tester is performing web application reconnaissance. The tester wants to discover hidden directories and files, identify the technologies used, and find API endpoints. Which THREE of the following tools are best suited for these tasks?

Accepted Answer

Gobuster. Gobuster (A) is correct because it is a dedicated content-discovery tool that brute-forces URIs, directories, files, and DNS subdomains using wordlists, directly satisfying the hidden-directory and file discovery requirement. ffuf (B) is correct because it is a fast web fuzzer that can fuzz directories, files, parameters, and virtual hosts, and is commonly used to enumerate API endpoints and hidden paths with customizable wordlists and filters. Wappalyzer (E) is correct because it fingerprints the technologies powering a web application — such as CMS, JavaScript frameworks, web servers, and programming languages — by analyzing headers, cookies, and DOM artifacts, which fulfills the technology-identification requirement. Nikto (C) is not among the marked answers because it is primarily a web server vulnerability scanner rather than a directory/file brute-forcer or technology fingerprinter. Burp Suite (D) is not marked because, although it is a comprehensive web proxy and testing platform, the question asks for the three tools best suited to these specific reconnaissance tasks, and Gobuster, ffuf, and Wappalyzer map more directly to directory discovery, endpoint fuzzing, and technology identification respectively.

Answer

Nikto

Answer

Burp Suite

Question 14

During an external penetration test, a tester discovers that the target organization has a Microsoft Exchange server exposed to the internet. The tester wants to enumerate valid user accounts without triggering account lockout policies or generating excessive authentication failures. Which tool and technique should the tester use?

Accepted Answer

Use the tool MailSniper's Invoke-UsernameHarvestOWA function to enumerate valid Exchange users via the OWA interface.. MailSniper's Invoke-UsernameHarvestOWA function is specifically designed to enumerate valid Exchange users via OWA without attempting authentication, thus avoiding account lockouts. Other options either target the wrong service, perform password spraying (which can lock accounts), or use brute-force techniques that are noisy and not focused on enumeration.

Answer

Use Nmap with the smb-enum-users NSE script to enumerate users via SMB.

Answer

Use the Metasploit auxiliary module auxiliary/scanner/http/owa_login with a username list to perform password spraying.

Answer

Use Hydra with the -L users.txt -P passwords.txt options against the Exchange server's SMTP port.

Question 15

A penetration tester is conducting reconnaissance on a target organization's external infrastructure. The tester wants to identify subdomains that may not be publicly advertised. Which two techniques are most effective for discovering subdomains during passive reconnaissance? (Choose two.)

Accepted Answer

Querying Certificate Transparency (CT) logs for issued certificates.. Certificate Transparency logs and historical DNS datasets are both passive sources that do not require direct interaction with the target. They aggregate publicly available information from certificate authorities and historical DNS records, making them effective for stealthy subdomain discovery. The other options involve active scanning or are less reliable for this purpose.

Answer

Performing a DNS zone transfer (AXFR) against the target's authoritative name servers.

Answer

Running a brute-force subdomain enumeration tool like Gobuster with a large wordlist.

Answer

Using the Shodan API to search for services associated with the target's IP ranges.

Question 16

A penetration tester is conducting reconnaissance on a target organization's external footprint. The tester discovers a list of IP addresses and wants to determine which ones belong to the target and what services they expose, while minimizing the chance of triggering intrusion detection systems. Which approach best balances thoroughness and stealth?

Accepted Answer

Use Nmap with a SYN scan, timing template T2, and fragmentation to probe common ports, then expand based on results. A SYN scan avoids completing the TCP handshake, reducing application logging, while timing template T2 slows packet transmission to avoid rate-based IDS triggers. Fragmentation can further evade simple signature detection. Beginning with common ports and expanding based on results keeps the scan focused and less noisy than a full aggressive scan or a slow connect scan.

Answer

Run a full TCP connect scan of all 65535 ports with timing template T4 to quickly map the entire attack surface

Answer

Perform a slow, randomized TCP connect scan with Nmap using timing template T2 and decoy addresses

Answer

Use a UDP scan of all ports with default timing to identify every possible service before any TCP probing

Question 17

A penetration tester is performing OSINT reconnaissance against a target company and wants to gather information that could support later social engineering and technical attacks. Which two sources are most likely to reveal employee names, email addresses, and technology stack details without directly contacting the target's infrastructure? (Choose two.)

Accepted Answer

Shodan search results for the target's IP ranges. LinkedIn and Shodan are third-party platforms that aggregate public and indexed data without the tester contacting the target directly. LinkedIn exposes employee names, roles, and sometimes email patterns, while Shodan reveals exposed services and technology fingerprints. SMTP VRFY, Nmap OS detection, and direct website browsing all involve direct interaction with the target, violating the passive collection constraint.

Answer

Nmap OS detection scans against discovered IP addresses

Answer

Manual browsing of the target's public website and job postings

Answer

Direct SMTP VRFY commands against the target's mail server

Question 18

During a penetration test, you need to gather information about a target's email addresses and employee names without directly interacting with the target's systems. Which tool is most appropriate for this passive reconnaissance task?

Accepted Answer

theHarvester. theHarvester is an OSINT tool designed to gather emails, subdomains, IPs, and employee names from public sources like search engines and social media. Maltego is more for relationship mapping, Shodan for internet-facing devices, and Censys for certificate and network data.

Answer

Shodan

Answer

Censys

Answer

Maltego

Question 19

You are performing a vulnerability scan on a web application and notice that the scanner reports a high-severity SQL injection vulnerability. However, manual testing confirms that the input is properly sanitized. Which term best describes this situation?

Accepted Answer

False positive. A false positive occurs when a scanner incorrectly identifies a vulnerability that does not exist. This is common in automated vulnerability scanning and requires manual verification.

Answer

False negative

Answer

True positive

Answer

Inconclusive

Question 20

Which Nmap scan type sends SYN packets to determine open ports without completing the TCP three-way handshake?

Accepted Answer

-sS. The SYN scan (-sS) sends a SYN packet and if a SYN/ACK is received, the port is considered open; it does not complete the handshake, making it stealthier than a full connect scan.

Answer

-sU

Answer

-sT

Answer

-sN