PT0-002 Reconnaissance and Enumeration Practice Test 4 — 15 Questions

Question 1

While performing vulnerability scanning, a penetration tester runs a Nessus scan against a web server. The report shows a 'critical' finding, but after manual verification, the tester determines the service is not actually vulnerable. This scenario best describes:

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A false positive. A false positive is when a scanner reports a vulnerability that does not actually exist. Penetration testers must verify scanner findings to avoid reporting false positives.

Answer

A false negative

Answer

A configuration error

Answer

A true positive

Question 2

A penetration tester is performing DNS reconnaissance and wants to enumerate all subdomains of a target domain by querying DNS servers in an attempt to transfer the entire zone file. Which technique is the tester using?

Accepted Answer

DNS zone transfer. DNS zone transfer (AXFR) is a mechanism that allows a secondary DNS server to replicate the entire zone file from a primary server. If misconfigured, anyone can request it.

Answer

DNS reverse lookup

Answer

DNS cache snooping

Answer

DNS tunneling

Question 3

A tester wants to identify the technologies used by a web application before conducting a deeper assessment. Which tool would be most appropriate for passive technology fingerprinting?

Accepted Answer

Wappalyzer. Wappalyzer is a browser extension or online tool that identifies web technologies (CMS, frameworks, analytics) by analyzing page content and headers without sending probes.

Answer

Nmap

Answer

OpenVAS

Answer

Nikto

Question 4

During a penetration test, the tester wants to discover publicly exposed IoT devices related to the target organization. Which OSINT tool is specifically designed for searching devices connected to the internet?

Accepted Answer

Shodan. Shodan is a search engine that indexes banners from internet-connected devices, including IoT, webcams, routers, and industrial control systems.

Answer

Censys

Answer

Maltego

Answer

theHarvester

Question 5

A penetration tester is analyzing a web application and wants to discover hidden API endpoints by brute-forcing common paths. Which tool is best suited for this task?

Accepted Answer

Feroxbuster. Feroxbuster is a fast, recursive content discovery tool that supports wordlist-based brute-forcing of directories, files, and API endpoints, with automatic recursion.

Answer

WPScan

Answer

theHarvester

Answer

Nikto

Question 6

A penetration tester is performing internal network scanning and wants to identify live hosts on a local subnet without sending IP packets. Which method is most effective in a switched Ethernet environment?

Accepted Answer

arp-scan. In a switched Ethernet environment, ARP (Address Resolution Protocol) operates at Layer 2 and does not require IP packets to discover hosts. The `arp-scan` tool sends ARP requests to the local broadcast MAC address, and live hosts respond with their MAC addresses, making it the most effective method for identifying live hosts without sending IP packets.

Answer

TCP SYN scan to common ports

Answer

Nmap ping sweep with -sn

Answer

SNMP walk

Question 7

A penetration tester is reviewing SSL/TLS certificate information for a target domain and wants to discover additional subdomains that share the same certificate. Which resource is best for this purpose?

Accepted Answer

crt.sh. Certificate Transparency logs (e.g., crt.sh) allow searching by domain or certificate fingerprint to find all certificates issued for that domain, often revealing subdomains.

Answer

Shodan

Answer

Google Dorks

Answer

Wayback Machine

Question 8

Which of the following tools would best assist a penetration tester in identifying known vulnerabilities in a WordPress installation?

Accepted Answer

WPScan. WPScan is specifically designed to enumerate and identify vulnerabilities in WordPress installations, including outdated plugins, themes, and core files. It uses a comprehensive database of WordPress CVEs and security issues, making it the most targeted tool for this task.

Answer

OpenVAS

Answer

Nessus

Answer

Nikto

Question 9

A penetration tester is conducting passive reconnaissance and wants to gather information about a target organization's employees, email addresses, and internal structure. Which TWO tools are best suited for this purpose? (Select TWO.)

Accepted Answer

Maltego. Maltego is a data mining tool that visualizes relationships and can collect info from social media, DNS, and other sources. theHarvester gathers emails, subdomains, and names from public sources. LinkedIn is also used for organizational chart mapping, but the question asks for tools specifically.

Answer

Gobuster

Answer

Nmap

Answer

Nikto

Question 10

A penetration tester is performing active reconnaissance on a web application and needs to discover parameters that the application accepts. Which TWO tools are most commonly used for parameter discovery? (Select TWO.)

Accepted Answer

ffuf. ffuf (Fuzz Faster U Fool) is a high-performance web fuzzer commonly used for parameter discovery by brute-forcing HTTP request parameters (GET/POST) against a target endpoint. Arjun is a dedicated parameter discovery tool that uses a wordlist of common parameter names and analyzes response differences (e.g., status codes, content length) to identify valid parameters. Both tools are specifically designed for active reconnaissance to enumerate hidden or undocumented parameters in web applications.

Answer

theHarvester

Answer

WPScan

Answer

Nikto

Question 11

A penetration tester is preparing to perform an authenticated vulnerability scan of a network. Which THREE of the following are important considerations before starting the scan? (Select THREE.)

Accepted Answer

Configuring the scanner to use the appropriate credentials. Authenticated scans require valid credentials to log into systems for deeper assessment. It's important to understand the risk of service disruption, ensure credentials have appropriate privileges, and obtain written authorization to avoid legal issues.

Answer

Using default community strings for SNMP

Answer

Selecting a random scan time to avoid detection

Question 12

A penetration tester is performing passive reconnaissance and wants to identify subdomains associated with a target domain without directly querying the target's DNS servers. Which tool is specifically designed for this purpose?

Accepted Answer

theHarvester. TheHarvester is specifically designed for passive reconnaissance, gathering subdomains from public sources like search engines (Google, Bing), PGP key servers, and the Shodan database without querying the target's DNS servers directly. This aligns with the requirement to avoid direct interaction with the target's infrastructure, making it the correct choice for passive subdomain enumeration.

Answer

WPScan

Answer

Nmap

Answer

Gobuster

Question 13

During a penetration test, a tester discovers a web application that uses JavaScript to load API endpoints dynamically. Which technique would be most effective for discovering hidden API endpoints?

Accepted Answer

Analyzing JavaScript files for API endpoints. JavaScript analysis involves inspecting JavaScript files for hardcoded API endpoints, secrets, and other useful information, making it effective for discovering hidden API endpoints.

Answer

Performing a DNS zone transfer

Answer

Running a Nikto scan

Answer

Using Nmap to scan for open ports and services

Question 14

A penetration tester is tasked with performing an authenticated vulnerability scan of a Windows network. The tester has domain admin credentials. Which tool is most appropriate for this task?

Accepted Answer

Nessus. Nessus supports authenticated scanning using credentials (e.g., domain admin) to perform deep vulnerability assessment of Windows systems, including missing patches and insecure configurations.

Answer

Nikto

Answer

Nmap

Answer

theHarvester

Question 15

A penetration tester runs a SYN scan against a target and receives SYN-ACK responses from several ports. The tester then runs version detection on those ports. What is the primary purpose of version detection?

Accepted Answer

To identify the software and version running on open ports. Version detection (-sV) in Nmap identifies the specific software and version running on open ports, helping assess potential vulnerabilities and plan further exploitation.

Answer

To identify the operating system of the target

Answer

To perform a vulnerability scan

Answer

To determine if the host is online