PT0-002 Reconnaissance and Enumeration Practice Test 2 — 15 Questions

Question 1

A penetration tester is performing web application reconnaissance and wants to discover API endpoints and hidden parameters that may not be linked from the main application. Which technique would be most effective for this purpose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

JavaScript analysis for endpoint discovery. JavaScript analysis often reveals AJAX API endpoints, keys, and parameters that are not visible in HTML. Directory bruteforcing may find endpoints but JS analysis is more targeted for hidden APIs.

Answer

Running Nikto for web server vulnerabilities

Answer

Directory bruteforcing with gobuster

Answer

Using Wappalyzer to fingerprint technologies

Question 2

A penetration tester is performing a vulnerability scan on a web server using Nikto. After the scan, the tester notices several findings related to outdated software versions and missing security headers. What should the tester do to validate the findings and reduce false positives?

Accepted Answer

Manually verify a subset of the findings. Manually verifying findings is the best practice to confirm if they are real vulnerabilities or false positives. Relying on scanner output alone is insufficient.

Answer

Ignore findings related to missing headers as low priority

Answer

Increase the scan intensity to get more details

Answer

Accept all findings as true since Nikto is a reliable tool

Question 3

During a penetration test, the tester wants to gather information about a target using publicly available DNS records, including mail servers, name servers, and possibly TXT records. Which type of DNS query would be most useful for obtaining a comprehensive list of these records?

Accepted Answer

AXFR zone transfer request. An AXFR (zone transfer) request is the correct choice because it retrieves the entire DNS zone file from a name server, which includes all record types (A, AAAA, MX, NS, TXT, etc.) for a domain. This provides a comprehensive list of publicly available DNS records, making it ideal for information gathering during a penetration test. In contrast, specific queries like NS or MX only return a single record type, limiting the scope of enumeration.

Answer

NS record query

Answer

MX record query

Answer

A record query

Question 4

A penetration tester is using Shodan to identify internet-facing devices associated with a target organization. Which of the following is Shodan's primary function in the context of passive reconnaissance?

Accepted Answer

Searching for devices and services exposed to the internet. Shodan is a search engine for internet-connected devices, providing information about services and banners. It does not perform active scans itself; it indexes data from active scanning.

Answer

Analyzing malware samples

Answer

Exploiting vulnerabilities in IoT devices

Answer

Performing live port scans on target IPs

Question 5

A penetration tester is conducting a web application assessment and discovers that the target uses WordPress. The tester wants to identify installed plugins, themes, and potential vulnerabilities. Which of the following tools is best suited for this task?

Accepted Answer

WPScan. WPScan is a dedicated WordPress security scanner that enumerates installed plugins, themes, and known vulnerabilities by querying the WordPress API and fingerprinting version-specific files. It is purpose-built for WordPress assessments, making it the best choice for this task.

Answer

OpenVAS

Answer

Nikto

Answer

Gobuster

Question 6

During the information gathering phase, a penetration tester uses Google dorks to find exposed documents on a target's website. Which Google dork would be most appropriate to find PDF files containing sensitive information?

Accepted Answer

filetype:pdf. The filetype:pdf dork restricts results to PDF files. Other dorks target different file types or content.

Answer

inurl:admin

Answer

site:target.com password

Answer

intitle:index.of

Question 7

A penetration tester is performing service enumeration on a discovered host and wants to grab banners from open ports to identify the exact software and version running. Which of the following command-line tools would be most appropriate for this task?

Accepted Answer

nc -v target.com 22. `nc -v target.com 22` uses Netcat in verbose mode to connect to port 22 on the target, which triggers the SSH server to send its banner (e.g., "SSH-2.0-OpenSSH_8.9p1"). This banner directly reveals the exact software and version running on that port, making it ideal for service enumeration and banner grabbing.

Answer

traceroute target.com

Answer

ping target.com

Answer

curl http://target.com

Question 8

A penetration tester is using OpenVAS to perform an authenticated vulnerability scan of a Linux server. The tester has provided valid SSH credentials. Which of the following is a primary benefit of performing an authenticated scan over an unauthenticated scan?

Accepted Answer

Ability to detect vulnerabilities that require local access. Authenticated scans have deeper access to the system, allowing the scanner to check configuration files, patch levels, and local vulnerabilities that are not visible externally.

Answer

Reduced network bandwidth usage

Answer

Faster scan completion time

Answer

Elimination of all false positives

Question 9

A penetration tester is conducting passive reconnaissance using OSINT techniques. Which TWO of the following are examples of passive OSINT sources?

Accepted Answer

Certificate transparency logs (crt.sh). Certificate transparency logs (crt.sh) are a passive OSINT source because they provide publicly accessible records of SSL/TLS certificates issued for domains. A penetration tester can query these logs without interacting with the target's systems, making it a non-intrusive information-gathering technique.

Answer

Social engineering

Answer

snmpwalk

Answer

Nmap SYN scan

Question 10

A penetration tester is performing host discovery on a subnet. Which TWO of the following Nmap options can be used to discover live hosts?

Accepted Answer

-sn. Both -sn (ping sweep) and -sP (older alias for ping sweep) perform host discovery without port scanning. -sS and -sV are for port scanning and version detection respectively, not host discovery.

Answer

-O

Answer

-sV

Answer

-sS

Question 11

A penetration tester is assessing a web application and wants to discover hidden directories, files, and parameters. Which THREE of the following tools are most appropriate for this task?

Accepted Answer

dirsearch. B (dirsearch) is correct because it is a purpose-built tool for brute-forcing hidden directories and files in web applications using HTTP GET requests and a wordlist. It efficiently discovers unlinked resources that are not exposed via normal navigation, which is critical for information gathering during a penetration test.

Answer

Nikto

Answer

Wappalyzer

Question 12

A penetration tester is performing passive reconnaissance on a target organization. Which of the following tools is best suited for gathering information from public sources such as search engines, social media, and website scraping?

Accepted Answer

theHarvester. theHarvester is an OSINT tool designed to gather emails, subdomains, IPs, and URLs from public sources like search engines and social media.

Answer

Metasploit

Answer

Nessus

Answer

Nmap

Question 13

During a penetration test, you are asked to discover all live hosts on a subnet without generating excessive traffic or being too intrusive. Which Nmap command best achieves this goal?

Accepted Answer

nmap -sn 192.168.1.0/24. The `-sn` flag (ping scan) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests to discover live hosts without performing port scans or service detection, minimizing traffic and intrusiveness. This meets the requirement of discovering all live hosts on a subnet efficiently.

Answer

nmap -O 192.168.1.0/24

Answer

nmap -A 192.168.1.0/24

Answer

nmap -sS 192.168.1.0/24

Question 14

A penetration tester uses Shodan to find internet-facing devices belonging to a target company. Which of the following Shodan search filters would most effectively identify devices with a specific organization name?

Accepted Answer

org:CompanyName. The 'org' filter in Shodan allows searching by organization name, which is the most direct way to find devices associated with a company.

Answer

hostname:company.com

Answer

ssl:company.com

Answer

net:192.168.0.0/16

Question 15

While performing web application reconnaissance, a tester wants to enumerate hidden directories and files on a web server. Which of the following tools is specifically designed for directory brute-forcing?

Accepted Answer

Gobuster. Gobuster is specifically designed for directory brute-forcing by using a wordlist to discover hidden directories and files on a web server. It sends HTTP GET requests to the target and reports valid responses (e.g., 200, 301, 403), making it the correct tool for this task.

Answer

Nikto

Answer

WPScan

Answer

Nmap