PT0-002 Information Gathering and Vulnerability Scanning Practice Test 2 — 15 Questions

Question 1

A penetration tester is performing passive reconnaissance on a target organization. Which of the following tools would be BEST suited to gather information about the organization's domain names, email addresses, and subdomains from publicly available sources without directly interacting with the target's systems?

Accepted Answer

theHarvester. theHarvester is designed for passive OSINT gathering of emails, subdomains, IPs, etc. Maltego is also OSINT but more graph-oriented; theHarvester is specifically for email/subdomain enumeration.

Answer

Nmap

Answer

Nessus

Answer

Metasploit

Question 2

During the information gathering phase, a penetration tester wants to discover subdomains of a target domain using DNS queries and potentially brute-forcing common subdomain names. Which of the following tools is specifically designed for subdomain enumeration and can perform both passive and active techniques?

Accepted Answer

Amass. Amass is a tool that performs subdomain enumeration using passive sources and active brute-forcing. Gobuster and dirsearch are for directory/file enumeration. Nmap is for port scanning.

Answer

Nmap

Answer

dirsearch

Answer

Gobuster

Question 3

A penetration tester is conducting active reconnaissance on a target network and wants to perform a SYN scan to identify open ports without completing the full TCP handshake. Which Nmap flag should the tester use?

Accepted Answer

-sS. The -sS flag specifies a SYN scan, which is stealthy and does not complete the three-way handshake.

Answer

-sA

Answer

-sU

Answer

-sT

Question 4

After gaining initial access to an internal network, a penetration tester wants to identify live hosts on a subnet without generating excessive traffic. Which Nmap command would be most appropriate for host discovery using ICMP echo requests and TCP SYN to port 80?

Accepted Answer

nmap -sn 192.168.1.0/24. Nmap's -sn flag performs a ping sweep, which by default uses ICMP echo, TCP SYN to port 80, and other probes. The other options are for port scanning or OS detection.

Answer

nmap -A 192.168.1.0/24

Answer

nmap -sS 192.168.1.0/24

Answer

nmap -O 192.168.1.0/24

Question 5

A penetration tester is performing web application reconnaissance and wants to discover API endpoints and hidden parameters that may not be linked from the main application. Which technique would be most effective for this purpose?

Accepted Answer

JavaScript analysis for endpoint discovery. JavaScript analysis often reveals AJAX API endpoints, keys, and parameters that are not visible in HTML. Directory bruteforcing may find endpoints but JS analysis is more targeted for hidden APIs.

Answer

Running Nikto for web server vulnerabilities

Answer

Directory bruteforcing with gobuster

Answer

Using Wappalyzer to fingerprint technologies

Question 6

A penetration tester is performing a vulnerability scan on a web server using Nikto. After the scan, the tester notices several findings related to outdated software versions and missing security headers. What should the tester do to validate the findings and reduce false positives?

Accepted Answer

Manually verify a subset of the findings. Manually verifying findings is the best practice to confirm if they are real vulnerabilities or false positives. Relying on scanner output alone is insufficient.

Answer

Ignore findings related to missing headers as low priority

Answer

Increase the scan intensity to get more details

Answer

Accept all findings as true since Nikto is a reliable tool

Question 7

During a penetration test, the tester wants to gather information about a target using publicly available DNS records, including mail servers, name servers, and possibly TXT records. Which type of DNS query would be most useful for obtaining a comprehensive list of these records?

Accepted Answer

AXFR zone transfer request. An AXFR (zone transfer) request is the correct choice because it retrieves the entire DNS zone file from a name server, which includes all record types (A, AAAA, MX, NS, TXT, etc.) for a domain. This provides a comprehensive list of publicly available DNS records, making it ideal for information gathering during a penetration test. In contrast, specific queries like NS or MX only return a single record type, limiting the scope of enumeration.

Answer

NS record query

Answer

MX record query

Answer

A record query

Question 8

A penetration tester is using Shodan to identify internet-facing devices associated with a target organization. Which of the following is Shodan's primary function in the context of passive reconnaissance?

Accepted Answer

Searching for devices and services exposed to the internet. Shodan is a search engine for internet-connected devices, providing information about services and banners. It does not perform active scans itself; it indexes data from active scanning.

Answer

Analyzing malware samples

Answer

Exploiting vulnerabilities in IoT devices

Answer

Performing live port scans on target IPs

Question 9

A penetration tester is conducting a web application assessment and discovers that the target uses WordPress. The tester wants to identify installed plugins, themes, and potential vulnerabilities. Which of the following tools is best suited for this task?

Accepted Answer

WPScan. WPScan is a dedicated WordPress security scanner that enumerates installed plugins, themes, and known vulnerabilities by querying the WordPress API and fingerprinting version-specific files. It is purpose-built for WordPress assessments, making it the best choice for this task.

Answer

OpenVAS

Answer

Nikto

Answer

Gobuster

Question 10

During the information gathering phase, a penetration tester uses Google dorks to find exposed documents on a target's website. Which Google dork would be most appropriate to find PDF files containing sensitive information?

Accepted Answer

filetype:pdf. The filetype:pdf dork restricts results to PDF files. Other dorks target different file types or content.

Answer

inurl:admin

Answer

site:target.com password

Answer

intitle:index.of

Question 11

A penetration tester is performing service enumeration on a discovered host and wants to grab banners from open ports to identify the exact software and version running. Which of the following command-line tools would be most appropriate for this task?

Accepted Answer

nc -v target.com 22. Option D is correct because `nc -v target.com 22` uses Netcat in verbose mode to connect to port 22 on the target, which triggers the SSH server to send its banner (e.g., "SSH-2.0-OpenSSH_8.9p1"). This banner directly reveals the exact software and version running on that port, making it ideal for service enumeration and banner grabbing.

Answer

traceroute target.com

Answer

ping target.com

Answer

curl http://target.com

Question 12

A penetration tester is using OpenVAS to perform an authenticated vulnerability scan of a Linux server. The tester has provided valid SSH credentials. Which of the following is a primary benefit of performing an authenticated scan over an unauthenticated scan?

Accepted Answer

Ability to detect vulnerabilities that require local access. Authenticated scans have deeper access to the system, allowing the scanner to check configuration files, patch levels, and local vulnerabilities that are not visible externally.

Answer

Reduced network bandwidth usage

Answer

Faster scan completion time

Answer

Elimination of all false positives

Question 13

A penetration tester is conducting passive reconnaissance using OSINT techniques. Which TWO of the following are examples of passive OSINT sources?

Accepted Answer

Certificate transparency logs (crt.sh). Certificate transparency logs (crt.sh) are a passive OSINT source because they provide publicly accessible records of SSL/TLS certificates issued for domains. A penetration tester can query these logs without interacting with the target's systems, making it a non-intrusive information-gathering technique.

Answer

Social engineering

Answer

snmpwalk

Answer

Nmap SYN scan

Question 14

A penetration tester is performing host discovery on a subnet. Which TWO of the following Nmap options can be used to discover live hosts?

Accepted Answer

-sn. Both -sn (ping sweep) and -sP (older alias for ping sweep) perform host discovery without port scanning. -sS and -sV are for port scanning and version detection respectively, not host discovery.

Answer

-O

Answer

-sV

Answer

-sS

Question 15

A penetration tester is assessing a web application and wants to discover hidden directories, files, and parameters. Which THREE of the following tools are most appropriate for this task?

Accepted Answer

dirsearch. B (dirsearch) is correct because it is a purpose-built tool for brute-forcing hidden directories and files in web applications using HTTP GET requests and a wordlist. It efficiently discovers unlinked resources that are not exposed via normal navigation, which is critical for information gathering during a penetration test.

Answer

Nikto

Answer

Wappalyzer