PT0-002 Information Gathering and Vulnerability Scanning — 25 Questions

Question 1

During a penetration test, you need to gather information about a target's email addresses and employee names without directly interacting with the target's systems. Which tool is most appropriate for this passive reconnaissance task?

Accepted Answer

theHarvester. theHarvester is an OSINT tool designed to gather emails, subdomains, IPs, and employee names from public sources like search engines and social media. Maltego is more for relationship mapping, Shodan for internet-facing devices, and Censys for certificate and network data.

Answer

Shodan

Answer

Censys

Answer

Maltego

Question 2

You are performing a vulnerability scan on a web application and notice that the scanner reports a high-severity SQL injection vulnerability. However, manual testing confirms that the input is properly sanitized. Which term best describes this situation?

Accepted Answer

False positive. A false positive occurs when a scanner incorrectly identifies a vulnerability that does not exist. This is common in automated vulnerability scanning and requires manual verification.

Answer

False negative

Answer

True positive

Answer

Inconclusive

Question 3

Which Nmap scan type sends SYN packets to determine open ports without completing the TCP three-way handshake?

Accepted Answer

-sS. The SYN scan (-sS) sends a SYN packet and if a SYN/ACK is received, the port is considered open; it does not complete the handshake, making it stealthier than a full connect scan.

Answer

-sU

Answer

-sT

Answer

-sN

Question 4

You are conducting a penetration test and need to identify subdomains of a target domain using a passive approach that does not generate traffic to the target's servers. Which technique should you use?

Accepted Answer

Certificate transparency logs. Certificate transparency logs (e.g., crt.sh) are public logs of SSL/TLS certificates, often containing subdomain names. Querying them is passive and does not interact with the target.

Answer

DNS cache snooping

Answer

Subdomain bruteforce with gobuster

Answer

DNS zone transfer

Question 5

During a penetration test, you want to discover API endpoints and hidden parameters in a web application. Which tool combination is most effective for this task?

Accepted Answer

Arjun and ffuf. Arjun is specifically designed for parameter discovery, while ffuf can be used to bruteforce both directories and parameters. Together they effectively find API endpoints and parameters. gobuster is for directory/file enumeration, not specifically for parameters.

Answer

Wappalyzer and curl

Answer

WhatWeb and theHarvester

Answer

Gobuster and Nikto

Question 6

Which tool is specifically designed for scanning WordPress websites to detect vulnerabilities, such as outdated plugins, themes, and weak passwords?

Accepted Answer

WPScan. WPScan is a dedicated WordPress security scanner that enumerates WordPress-specific vulnerabilities, including outdated plugins, themes, and weak passwords via XML-RPC brute-force testing. It uses the WordPress vulnerability database (wpvulndb.com) to match installed versions against known CVEs, making it the correct tool for this targeted task.

Answer

OpenVAS

Answer

Nikto

Answer

Nessus

Question 7

You are performing a network scan and need to identify live hosts on a subnet without triggering firewalls that block ICMP. Which technique should you use?

Accepted Answer

ARP scan with arp-scan. Using ARP scan (arp-scan) works on local networks and does not rely on ICMP, making it effective even when ICMP is blocked. It sends ARP requests and listens for replies.

Answer

Ping sweep with nmap -sn

Answer

TCP SYN ping with nmap -PS

Answer

UDP scan with nmap -sU

Question 8

During a penetration test, you find a web application that uses JavaScript to make API calls. You want to discover hidden API endpoints and potential secrets (e.g., API keys) embedded in the client-side code. Which approach is most appropriate?

Accepted Answer

Download and analyze the JavaScript files. Option A is correct because JavaScript files in client-side web applications often contain hardcoded API endpoints, API keys, and other secrets that developers inadvertently leave in the source code. By downloading and analyzing these files (e.g., via browser developer tools or wget), you can discover hidden endpoints and sensitive tokens that are not exposed in the HTML or network traffic alone.

Answer

Perform a DNS zone transfer

Answer

Run a Nikto scan against the application

Answer

Use theHarvester to search for API endpoints

Question 9

In the context of OSINT, which resource would you use to find historical versions of a company's website that may reveal outdated information or hidden directories?

Accepted Answer

Wayback Machine. The Wayback Machine (archive.org) is the correct resource because it archives historical snapshots of websites, allowing you to view past versions that may contain outdated information, hidden directories, or old configurations no longer present on the live site. This is a core OSINT technique for discovering legacy content or forgotten endpoints.

Answer

crt.sh

Answer

Censys

Answer

Shodan

Question 10

You are performing a vulnerability scan on an internal network using an authenticated scanner. Which of the following is a primary benefit of authenticated scanning compared to unauthenticated scanning?

Accepted Answer

It provides more accurate identification of vulnerabilities that require credentials. Authenticated scanning provides deeper insight by checking for missing patches, misconfigurations, and vulnerabilities that require valid credentials to detect, such as local privilege escalation issues.

Answer

It eliminates false positives entirely

Answer

It reduces network traffic

Answer

It avoids detection by intrusion detection systems

Question 11

During a penetration test, you want to perform a stealthy port scan that minimizes the chance of being logged by the target. Which Nmap option should you use?

Accepted Answer

-sS. SYN scan (-sS) is considered stealthy because it does not complete the TCP handshake, reducing the likelihood of being logged compared to a full connect scan.

Answer

-sU

Answer

-sV

Answer

-sT

Question 12

You are tasked with identifying the technologies used by a web application (e.g., web server, frameworks, libraries) during the reconnaissance phase. Which tool would you use?

Accepted Answer

WhatWeb. WhatWeb is a tool for fingerprinting web technologies. It identifies software, frameworks, and other components by analyzing HTTP responses and page content. Wappalyzer is a browser extension but WhatWeb is command-line and scriptable.

Answer

Gobuster

Answer

theHarvester

Answer

Nmap

Question 13

You are conducting passive reconnaissance on a target organization. Which of the following are examples of passive reconnaissance techniques? (Select TWO.)

Accepted Answer

Querying certificate transparency logs. Passive reconnaissance involves collecting information without directly interacting with the target's systems. WHOIS lookups and certificate transparency logs are passive. DNS zone transfer and port scanning are active. Social engineering is active.

Answer

DNS zone transfer

Answer

Scanning ports with Nmap

Answer

Sending phishing emails

Question 14

During a penetration test, you need to enumerate SNMP information from network devices. Which of the following tools or commands can be used for SNMP enumeration? (Select TWO.)

Accepted Answer

snmpwalk. snmpwalk is a classic tool to walk through the SNMP MIB tree. onesixtyone is a tool for brute-forcing SNMP community strings. nmap can also be used with scripts, but snmp-check is a specific tool. snmpwalk and onesixtyone are direct SNMP enumeration tools.

Answer

nmap -sU

Answer

curl

Answer

snmp-check

Question 15

You are performing reconnaissance on a target's web application. Which of the following techniques can be used to discover hidden directories and files? (Select THREE.)

Accepted Answer

Using feroxbuster. Directory bruteforce tools like dirsearch, gobuster, and feroxbuster are designed to discover hidden directories and files by using wordlists. Nikto is a vulnerability scanner, not primarily for directory discovery. theHarvester is for email/subdomain harvesting.

Answer

Running Nikto with default options

Answer

Querying theHarvester

Question 16

A penetration tester is performing passive reconnaissance on a target organization. Which of the following tools would be BEST suited to gather information about the organization's domain names, email addresses, and subdomains from publicly available sources without directly interacting with the target's systems?

Accepted Answer

theHarvester. theHarvester is designed for passive OSINT gathering of emails, subdomains, IPs, etc. Maltego is also OSINT but more graph-oriented; theHarvester is specifically for email/subdomain enumeration.

Answer

Nmap

Answer

Nessus

Answer

Metasploit

Question 17

During the information gathering phase, a penetration tester wants to discover subdomains of a target domain using DNS queries and potentially brute-forcing common subdomain names. Which of the following tools is specifically designed for subdomain enumeration and can perform both passive and active techniques?

Accepted Answer

Amass. Amass is a tool that performs subdomain enumeration using passive sources and active brute-forcing. Gobuster and dirsearch are for directory/file enumeration. Nmap is for port scanning.

Answer

Nmap

Answer

dirsearch

Answer

Gobuster

Question 18

A penetration tester is conducting active reconnaissance on a target network and wants to perform a SYN scan to identify open ports without completing the full TCP handshake. Which Nmap flag should the tester use?

Accepted Answer

-sS. The -sS flag specifies a SYN scan, which is stealthy and does not complete the three-way handshake.

Answer

-sA

Answer

-sU

Answer

-sT

Question 19

After gaining initial access to an internal network, a penetration tester wants to identify live hosts on a subnet without generating excessive traffic. Which Nmap command would be most appropriate for host discovery using ICMP echo requests and TCP SYN to port 80?

Accepted Answer

nmap -sn 192.168.1.0/24. Nmap's -sn flag performs a ping sweep, which by default uses ICMP echo, TCP SYN to port 80, and other probes. The other options are for port scanning or OS detection.

Answer

nmap -A 192.168.1.0/24

Answer

nmap -sS 192.168.1.0/24

Answer

nmap -O 192.168.1.0/24

Question 20

A penetration tester is performing web application reconnaissance and wants to discover API endpoints and hidden parameters that may not be linked from the main application. Which technique would be most effective for this purpose?

Accepted Answer

JavaScript analysis for endpoint discovery. JavaScript analysis often reveals AJAX API endpoints, keys, and parameters that are not visible in HTML. Directory bruteforcing may find endpoints but JS analysis is more targeted for hidden APIs.

Answer

Running Nikto for web server vulnerabilities

Answer

Directory bruteforcing with gobuster

Answer

Using Wappalyzer to fingerprint technologies