PT0-002 Information Gathering and Vulnerability Scanning Practice Test 3 — 15 Questions

Question 1

A penetration tester is performing passive reconnaissance on a target organization. Which of the following tools is best suited for gathering information from public sources such as search engines, social media, and website scraping?

Accepted Answer

theHarvester. theHarvester is an OSINT tool designed to gather emails, subdomains, IPs, and URLs from public sources like search engines and social media.

Answer

Metasploit

Answer

Nessus

Answer

Nmap

Question 2

During a penetration test, you are asked to discover all live hosts on a subnet without generating excessive traffic or being too intrusive. Which Nmap command best achieves this goal?

Accepted Answer

nmap -sn 192.168.1.0/24. Option B is correct because the `-sn` flag (ping scan) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests to discover live hosts without performing port scans or service detection, minimizing traffic and intrusiveness. This meets the requirement of discovering all live hosts on a subnet efficiently.

Answer

nmap -O 192.168.1.0/24

Answer

nmap -A 192.168.1.0/24

Answer

nmap -sS 192.168.1.0/24

Question 3

A penetration tester uses Shodan to find internet-facing devices belonging to a target company. Which of the following Shodan search filters would most effectively identify devices with a specific organization name?

Accepted Answer

org:CompanyName. The 'org' filter in Shodan allows searching by organization name, which is the most direct way to find devices associated with a company.

Answer

hostname:company.com

Answer

ssl:company.com

Answer

net:192.168.0.0/16

Question 4

While performing web application reconnaissance, a tester wants to enumerate hidden directories and files on a web server. Which of the following tools is specifically designed for directory brute-forcing?

Accepted Answer

Gobuster. Gobuster is specifically designed for directory brute-forcing by using a wordlist to discover hidden directories and files on a web server. It sends HTTP GET requests to the target and reports valid responses (e.g., 200, 301, 403), making it the correct tool for this task.

Answer

Nikto

Answer

WPScan

Answer

Nmap

Question 5

A penetration tester is conducting active reconnaissance and wants to perform a SYN scan on a target network. During the scan, the tester notices that some ports are reported as filtered. What does a filtered port status typically indicate in Nmap?

Accepted Answer

A firewall is blocking the probe packets.. Filtered ports in Nmap indicate that a firewall, packet filter, or other network obstacle is blocking the probe packets, preventing Nmap from determining whether the port is open or closed.

Answer

The port is closed and the target responded with a RST packet.

Answer

The port is open but no service is listening.

Answer

The target is not responding to any probes.

Question 6

When performing vulnerability scanning, which of the following best describes a false positive?

Accepted Answer

A vulnerability that the scanner reports but does not actually exist.. A false positive in vulnerability scanning occurs when the scanner reports a vulnerability that does not actually exist. This is option C. False positives are caused by factors such as overly aggressive signature matching, misconfigured scan profiles, or incomplete verification of service responses. They waste resources by prompting unnecessary remediation efforts.

Answer

A vulnerability that is correctly identified and verified.

Answer

A vulnerability that is exploited during the test.

Answer

A vulnerability that exists but the scanner fails to detect it.

Question 7

A penetration tester is using Nmap to identify the operating system of a target host. Which Nmap option should be used to enable OS detection?

Accepted Answer

-O. The -O option enables OS detection in Nmap.

Answer

-sV

Answer

-sC

Answer

-A

Question 8

A tester is performing DNS enumeration on a domain and wants to attempt a zone transfer. Which DNS record type is primarily used for zone transfers?

Accepted Answer

AXFR. Zone transfers use the AXFR (Authoritative Transfer) record type to replicate DNS data between servers.

Answer

SOA

Answer

NS

Answer

PTR

Question 9

During a web application penetration test, the tester wants to identify the technologies used by the target website. Which of the following tools is best suited for technology fingerprinting?

Accepted Answer

WhatWeb. Wappalyzer is a browser extension and online tool that identifies web technologies such as frameworks, CMS, and server software.

Answer

Nikto

Answer

Nmap

Answer

Gobuster

Question 10

Which of the following is a common community string used in SNMP enumeration?

Accepted Answer

public. The default community strings for SNMP are often 'public' for read-only and 'private' for read-write access.

Answer

root

Answer

snmp

Answer

admin

Question 11

A penetration tester is evaluating the security of a WordPress site. Which tool is specifically designed to scan WordPress installations for vulnerabilities?

Accepted Answer

WPScan. WPScan is a dedicated WordPress vulnerability scanner that checks for known vulnerabilities in WordPress core, plugins, and themes.

Answer

Nessus

Answer

OpenVAS

Answer

Nikto

Question 12

During a penetration test, the tester runs an Nmap scan with the -sV option and gets a result showing 'Apache httpd 2.4.49'. This version is known to be vulnerable to a path traversal attack. Which of the following best describes the next step the tester should take?

Accepted Answer

Attempt to exploit the vulnerability using a known exploit.. After identifying a potentially vulnerable service, the tester should verify the vulnerability by attempting exploitation in a controlled manner to avoid false positives.

Answer

Ignore it because Nmap version detection is unreliable.

Answer

Report the vulnerability immediately.

Answer

Move on to other targets since the vulnerability is well-known.

Question 13

A penetration tester is performing passive reconnaissance on a target organization. Which TWO of the following sources can provide information about the organization's historical web content? (Select TWO.)

Accepted Answer

Wayback Machine. The Wayback Machine archives historical snapshots of websites, and Pastebin can contain pasted content from the organization, including historical data.

Answer

Nmap

Answer

Shodan

Answer

Wireshark

Question 14

A penetration tester is conducting active reconnaissance on a target network and wants to enumerate SNMP information. Which TWO of the following tools or commands can be used to query SNMP data from network devices? (Select TWO.)

Accepted Answer

snmpwalk. snmpwalk is a standard SNMP tool to retrieve a subtree of MIB data, and nmap can be used with SNMP scripts to enumerate information.

Answer

WPScan

Answer

dig

Answer

tcpdump

Question 15

During a web application penetration test, the tester wants to discover hidden API endpoints. Which THREE of the following techniques can be used to achieve this? (Select THREE.)

Accepted Answer

Analyzing JavaScript files for API calls. Directory enumeration tools like gobuster or feroxbuster can find API paths; JavaScript analysis can reveal API calls; and parameter discovery tools like Arjun can find endpoints by brute-forcing parameters.

Answer

Performing a zone transfer

Answer

Running Nmap with service version detection