PT0-002 Information Gathering and Vulnerability Scanning Practice Test 4 — 15 Questions

Question 1

A penetration tester is conducting passive reconnaissance on a target organization. Which of the following tools is specifically designed for gathering OSINT by extracting email addresses, subdomains, and employee names from public sources?

Accepted Answer

theHarvester. theHarvester is a popular OSINT tool used to gather emails, subdomains, IPs, and employee names from public sources like search engines, PGP key servers, and social networks.

Answer

Nikto

Answer

WPScan

Answer

Nmap

Question 2

During a penetration test, the tester wants to identify live hosts on a network without performing a full port scan. Which Nmap command is most appropriate for this task?

Accepted Answer

nmap -sn 192.168.1.0/24. The -sn flag in Nmap performs a ping sweep (host discovery) without port scanning, sending ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default.

Answer

nmap -A 192.168.1.0/24

Answer

nmap -O 192.168.1.0/24

Answer

nmap -sS 192.168.1.0/24

Question 3

A penetration tester is performing active reconnaissance on a web application and wants to discover hidden directories and files. Which tool would be most effective for brute-forcing directory names based on a wordlist?

Accepted Answer

Gobuster. Gobuster is a tool used for directory/file brute-forcing using wordlists. Dirb is similar but older; gobuster is more modern and flexible.

Answer

Nikto

Answer

theHarvester

Answer

WPScan

Question 4

A tester is scanning a target network using Nmap. The client wants minimal disruption and asks to avoid completing TCP three-way handshakes. Which scan type should the tester use?

Accepted Answer

SYN scan (-sS). A SYN scan (nmap -sS) sends SYN packets and analyzes responses without completing the handshake, making it stealthier than a full connect scan.

Answer

TCP connect scan (-sT)

Answer

UDP scan (-sU)

Answer

Ping sweep (-sn)

Question 5

While performing vulnerability scanning, a penetration tester runs a Nessus scan against a web server. The report shows a 'critical' finding, but after manual verification, the tester determines the service is not actually vulnerable. This scenario best describes:

Accepted Answer

A false positive. A false positive is when a scanner reports a vulnerability that does not actually exist. Penetration testers must verify scanner findings to avoid reporting false positives.

Answer

A false negative

Answer

A configuration error

Answer

A true positive

Question 6

A penetration tester is performing DNS reconnaissance and wants to enumerate all subdomains of a target domain by querying DNS servers in an attempt to transfer the entire zone file. Which technique is the tester using?

Accepted Answer

DNS zone transfer. DNS zone transfer (AXFR) is a mechanism that allows a secondary DNS server to replicate the entire zone file from a primary server. If misconfigured, anyone can request it.

Answer

DNS reverse lookup

Answer

DNS cache snooping

Answer

DNS tunneling

Question 7

A tester wants to identify the technologies used by a web application before conducting a deeper assessment. Which tool would be most appropriate for passive technology fingerprinting?

Accepted Answer

Wappalyzer. Wappalyzer is a browser extension or online tool that identifies web technologies (CMS, frameworks, analytics) by analyzing page content and headers without sending probes.

Answer

Nmap

Answer

OpenVAS

Answer

Nikto

Question 8

During a penetration test, the tester wants to discover publicly exposed IoT devices related to the target organization. Which OSINT tool is specifically designed for searching devices connected to the internet?

Accepted Answer

Shodan. Shodan is a search engine that indexes banners from internet-connected devices, including IoT, webcams, routers, and industrial control systems.

Answer

Censys

Answer

Maltego

Answer

theHarvester

Question 9

A penetration tester is analyzing a web application and wants to discover hidden API endpoints by brute-forcing common paths. Which tool is best suited for this task?

Accepted Answer

Feroxbuster. Feroxbuster is a fast, recursive content discovery tool that supports wordlist-based brute-forcing of directories, files, and API endpoints, with automatic recursion.

Answer

WPScan

Answer

theHarvester

Answer

Nikto

Question 10

A penetration tester is performing internal network scanning and wants to identify live hosts on a local subnet without sending IP packets. Which method is most effective in a switched Ethernet environment?

Accepted Answer

arp-scan. In a switched Ethernet environment, ARP (Address Resolution Protocol) operates at Layer 2 and does not require IP packets to discover hosts. The `arp-scan` tool sends ARP requests to the local broadcast MAC address, and live hosts respond with their MAC addresses, making it the most effective method for identifying live hosts without sending IP packets.

Answer

TCP SYN scan to common ports

Answer

Nmap ping sweep with -sn

Answer

SNMP walk

Question 11

A penetration tester is reviewing SSL/TLS certificate information for a target domain and wants to discover additional subdomains that share the same certificate. Which resource is best for this purpose?

Accepted Answer

crt.sh. Certificate Transparency logs (e.g., crt.sh) allow searching by domain or certificate fingerprint to find all certificates issued for that domain, often revealing subdomains.

Answer

Shodan

Answer

Google Dorks

Answer

Wayback Machine

Question 12

Which of the following tools would best assist a penetration tester in identifying known vulnerabilities in a WordPress installation?

Accepted Answer

WPScan. WPScan is specifically designed to enumerate and identify vulnerabilities in WordPress installations, including outdated plugins, themes, and core files. It uses a comprehensive database of WordPress CVEs and security issues, making it the most targeted tool for this task.

Answer

OpenVAS

Answer

Nessus

Answer

Nikto

Question 13

A penetration tester is conducting passive reconnaissance and wants to gather information about a target organization's employees, email addresses, and internal structure. Which TWO tools are best suited for this purpose? (Select TWO.)

Accepted Answer

Maltego. Maltego is a data mining tool that visualizes relationships and can collect info from social media, DNS, and other sources. theHarvester gathers emails, subdomains, and names from public sources. LinkedIn is also used for organizational chart mapping, but the question asks for tools specifically.

Answer

Gobuster

Answer

Nmap

Answer

Nikto

Question 14

A penetration tester is performing active reconnaissance on a web application and needs to discover parameters that the application accepts. Which TWO tools are most commonly used for parameter discovery? (Select TWO.)

Accepted Answer

ffuf. ffuf (Fuzz Faster U Fool) is a high-performance web fuzzer commonly used for parameter discovery by brute-forcing HTTP request parameters (GET/POST) against a target endpoint. Arjun is a dedicated parameter discovery tool that uses a wordlist of common parameter names and analyzes response differences (e.g., status codes, content length) to identify valid parameters. Both tools are specifically designed for active reconnaissance to enumerate hidden or undocumented parameters in web applications.

Answer

theHarvester

Answer

WPScan

Answer

Nikto

Question 15

A penetration tester is preparing to perform an authenticated vulnerability scan of a network. Which THREE of the following are important considerations before starting the scan? (Select THREE.)

Accepted Answer

Configuring the scanner to use the appropriate credentials. Authenticated scans require valid credentials to log into systems for deeper assessment. It's important to understand the risk of service disruption, ensure credentials have appropriate privileges, and obtain written authorization to avoid legal issues.

Answer

Using default community strings for SNMP

Answer

Selecting a random scan time to avoid detection