PT0-002 Reconnaissance and Enumeration Practice Test 3 — 15 Questions

Question 1

A penetration tester is conducting active reconnaissance and wants to perform a SYN scan on a target network. During the scan, the tester notices that some ports are reported as filtered. What does a filtered port status typically indicate in Nmap?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A firewall is blocking the probe packets.. Filtered ports in Nmap indicate that a firewall, packet filter, or other network obstacle is blocking the probe packets, preventing Nmap from determining whether the port is open or closed.

Answer

The port is closed and the target responded with a RST packet.

Answer

The port is open but no service is listening.

Answer

The target is not responding to any probes.

Question 2

When performing vulnerability scanning, which of the following best describes a false positive?

Accepted Answer

A vulnerability that the scanner reports but does not actually exist.. A false positive in vulnerability scanning occurs when the scanner reports a vulnerability that does not actually exist. This is option C. False positives are caused by factors such as overly aggressive signature matching, misconfigured scan profiles, or incomplete verification of service responses. They waste resources by prompting unnecessary remediation efforts.

Answer

A vulnerability that is correctly identified and verified.

Answer

A vulnerability that is exploited during the test.

Answer

A vulnerability that exists but the scanner fails to detect it.

Question 3

A penetration tester is using Nmap to identify the operating system of a target host. Which Nmap option should be used to enable OS detection?

Accepted Answer

-O. The -O option enables OS detection in Nmap.

Answer

-sV

Answer

-sC

Answer

-A

Question 4

A tester is performing DNS enumeration on a domain and wants to attempt a zone transfer. Which DNS record type is primarily used for zone transfers?

Accepted Answer

AXFR. Zone transfers use the AXFR (Authoritative Transfer) record type to replicate DNS data between servers.

Answer

SOA

Answer

NS

Answer

PTR

Question 5

During a web application penetration test, the tester wants to identify the technologies used by the target website. Which of the following tools is best suited for technology fingerprinting?

Accepted Answer

WhatWeb. WhatWeb is specifically designed for web technology fingerprinting, identifying technologies such as frameworks, CMS, and server software by analyzing HTTP responses and page content. Nikto is a vulnerability scanner, Nmap is a network mapper, and Gobuster is a directory/file brute-forcer; none are primarily focused on technology identification.

Answer

Nikto

Answer

Nmap

Answer

Gobuster

Question 6

Which of the following is a common community string used in SNMP enumeration?

Accepted Answer

public. The default community strings for SNMP are often 'public' for read-only and 'private' for read-write access.

Answer

root

Answer

snmp

Answer

admin

Question 7

A penetration tester is evaluating the security of a WordPress site. Which tool is specifically designed to scan WordPress installations for vulnerabilities?

Accepted Answer

WPScan. WPScan is a dedicated WordPress vulnerability scanner that checks for known vulnerabilities in WordPress core, plugins, and themes.

Answer

Nessus

Answer

OpenVAS

Answer

Nikto

Question 8

During a penetration test, the tester runs an Nmap scan with the -sV option and gets a result showing 'Apache httpd 2.4.49'. This version is known to be vulnerable to a path traversal attack. Which of the following best describes the next step the tester should take?

Accepted Answer

Attempt to exploit the vulnerability using a known exploit.. After identifying a potentially vulnerable service, the tester should verify the vulnerability by attempting exploitation in a controlled manner to avoid false positives.

Answer

Ignore it because Nmap version detection is unreliable.

Answer

Report the vulnerability immediately.

Answer

Move on to other targets since the vulnerability is well-known.

Question 9

A penetration tester is performing passive reconnaissance on a target organization. Which TWO of the following sources can provide information about the organization's historical web content? (Select TWO.)

Accepted Answer

Wayback Machine. The Wayback Machine archives historical snapshots of websites, and Pastebin can contain pasted content from the organization, including historical data.

Answer

Nmap

Answer

Shodan

Answer

Wireshark

Question 10

A penetration tester is conducting active reconnaissance and wants to perform a SYN scan on a target network. During the scan, the tester notices that some ports are reported as filtered. What does a filtered port status typically indicate in Nmap?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

snmpwalk. snmpwalk is a standard SNMP tool to retrieve a subtree of MIB data, and nmap can be used with SNMP scripts to enumerate information.

Answer

WPScan

Answer

dig

Answer

tcpdump

Question 11

During a web application penetration test, the tester wants to discover hidden API endpoints. Which THREE of the following techniques can be used to achieve this? (Select THREE.)

Accepted Answer

Analyzing JavaScript files for API calls. Directory enumeration tools like gobuster or feroxbuster can find API paths; JavaScript analysis can reveal API calls; and parameter discovery tools like Arjun can find endpoints by brute-forcing parameters.

Answer

Performing a zone transfer

Answer

Running Nmap with service version detection

Question 12

A penetration tester is conducting passive reconnaissance on a target organization. Which of the following tools is specifically designed for gathering OSINT by extracting email addresses, subdomains, and employee names from public sources?

Accepted Answer

theHarvester. theHarvester is a popular OSINT tool used to gather emails, subdomains, IPs, and employee names from public sources like search engines, PGP key servers, and social networks.

Answer

Nikto

Answer

WPScan

Answer

Nmap

Question 13

During a penetration test, the tester wants to identify live hosts on a network without performing a full port scan. Which Nmap command is most appropriate for this task?

Accepted Answer

nmap -sn 192.168.1.0/24. The -sn flag in Nmap performs a ping sweep (host discovery) without port scanning, sending ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default.

Answer

nmap -A 192.168.1.0/24

Answer

nmap -O 192.168.1.0/24

Answer

nmap -sS 192.168.1.0/24

Question 14

A penetration tester is performing active reconnaissance on a web application and wants to discover hidden directories and files. Which tool would be most effective for brute-forcing directory names based on a wordlist?

Accepted Answer

Gobuster. Gobuster is a tool used for directory/file brute-forcing using wordlists. Dirb is similar but older; gobuster is more modern and flexible.

Answer

Nikto

Answer

theHarvester

Answer

WPScan

Question 15

A tester is scanning a target network using Nmap. The client wants minimal disruption and asks to avoid completing TCP three-way handshakes. Which scan type should the tester use?

Accepted Answer

SYN scan (-sS). A SYN scan (nmap -sS) sends SYN packets and analyzes responses without completing the handshake, making it stealthier than a full connect scan.

Answer

TCP connect scan (-sT)

Answer

UDP scan (-sU)

Answer

Ping sweep (-sn)