PT0-002 Information Gathering and Vulnerability Scanning Practice Test 5 — 15 Questions

Question 1

A penetration tester is performing passive reconnaissance and wants to identify subdomains associated with a target domain without directly querying the target's DNS servers. Which tool is specifically designed for this purpose?

Accepted Answer

theHarvester. TheHarvester is specifically designed for passive reconnaissance, gathering subdomains from public sources like search engines (Google, Bing), PGP key servers, and the Shodan database without querying the target's DNS servers directly. This aligns with the requirement to avoid direct interaction with the target's infrastructure, making it the correct choice for passive subdomain enumeration.

Answer

WPScan

Answer

Nmap

Answer

Gobuster

Question 2

During a penetration test, a tester discovers a web application that uses JavaScript to load API endpoints dynamically. Which technique would be most effective for discovering hidden API endpoints?

Accepted Answer

Analyzing JavaScript files for API endpoints. JavaScript analysis involves inspecting JavaScript files for hardcoded API endpoints, secrets, and other useful information, making it effective for discovering hidden API endpoints.

Answer

Performing a DNS zone transfer

Answer

Running a Nikto scan

Answer

Using Nmap to scan for open ports and services

Question 3

A penetration tester is tasked with performing an authenticated vulnerability scan of a Windows network. The tester has domain admin credentials. Which tool is most appropriate for this task?

Accepted Answer

Nessus. Nessus supports authenticated scanning using credentials (e.g., domain admin) to perform deep vulnerability assessment of Windows systems, including missing patches and insecure configurations.

Answer

Nikto

Answer

Nmap

Answer

theHarvester

Question 4

A penetration tester runs a SYN scan against a target and receives SYN-ACK responses from several ports. The tester then runs version detection on those ports. What is the primary purpose of version detection?

Accepted Answer

To identify the software and version running on open ports. Version detection (-sV) in Nmap identifies the specific software and version running on open ports, helping assess potential vulnerabilities and plan further exploitation.

Answer

To identify the operating system of the target

Answer

To perform a vulnerability scan

Answer

To determine if the host is online

Question 5

A penetration tester is using Google dorks to find sensitive information about a target organization. Which search operator would help the tester find PDF files containing the word 'confidential' on the target's website?

Accepted Answer

site:target.com filetype:pdf intext:confidential. The filetype operator filters results by file extension (e.g., pdf), and the intext operator searches for the specified text within the page content.

Answer

site:target.com ext:pdf confidential

Answer

site:target.com intitle:confidential pdf

Answer

inurl:target.com filetype:pdf confidential

Question 6

During a penetration test, a tester wants to discover all live hosts on a subnet without performing a full port scan. Which Nmap command is most appropriate for this purpose?

Accepted Answer

nmap -sn 192.168.1.0/24. The -sn flag performs a ping sweep (host discovery) without port scanning, which is the standard method to discover live hosts on a subnet efficiently.

Answer

nmap -sS 192.168.1.0/24

Answer

nmap -O 192.168.1.0/24

Answer

nmap -A 192.168.1.0/24

Question 7

A penetration tester is assessing a web application and wants to identify hidden parameters that the application accepts. Which tool is specifically designed for parameter discovery?

Accepted Answer

Arjun. Arjun is a tool for discovering HTTP parameters by brute-forcing common parameter names and analyzing responses for changes, making it suitable for parameter discovery.

Answer

WPScan

Answer

Nikto

Answer

Gobuster

Question 8

A penetration tester is performing SNMP enumeration on a target network. Which command would likely be used to extract information from a device with the community string 'public'?

Accepted Answer

snmpwalk -v 2c -c public target_ip. snmpwalk is a standard tool for retrieving a subtree of SNMP MIB data, often used for enumeration with the -v 2c version and -c community string.

Answer

snmpget -v 2c -c public target_ip

Answer

snmpset -v 2c -c public target_ip

Answer

snmpbulkwalk -v 2c -c public target_ip

Question 9

Which of the following tools is most commonly used for passive reconnaissance by querying certificate transparency logs to discover subdomains?

Accepted Answer

crt.sh. crt.sh is a certificate transparency log search tool that can be used to find subdomains by querying SSL/TLS certificates issued for a domain.

Answer

Censys

Answer

theHarvester

Answer

Shodan

Question 10

A penetration tester wants to perform a directory brute-force attack against a web server to discover hidden files and directories. Which tool is best suited for this task?

Accepted Answer

Gobuster. Gobuster is a popular tool for directory and file brute-forcing using wordlists, making it ideal for discovering hidden resources on web servers.

Answer

WPScan

Answer

Nikto

Answer

Nmap

Question 11

During a penetration test, a tester uses the Wayback Machine to review historical versions of the target's website. What is the primary benefit of this activity?

Accepted Answer

It reveals old web pages that may contain sensitive information or forgotten endpoints. The Wayback Machine archives historical snapshots of web pages, which can reveal old files, endpoints, or sensitive information that may have been removed but are still accessible on the live site.

Answer

It bypasses the target's WAF

Answer

It provides real-time vulnerability data

Answer

It performs a live vulnerability scan

Question 12

A penetration tester is using Nmap to perform an aggressive scan of a target. Which command combines OS detection, version detection, script scanning, and traceroute?

Accepted Answer

nmap -A target. The -A flag enables aggressive scanning which includes OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute (--traceroute).

Answer

nmap -sV -O target

Answer

nmap -sC -O target

Answer

nmap -T4 -sV target

Question 13

A penetration tester is performing active reconnaissance on a target web application. Which TWO tools are specifically designed for directory and file enumeration? (Select TWO.)

Accepted Answer

Feroxbuster. Gobuster and Feroxbuster are both tools specifically designed for directory and file brute-forcing on web servers.

Answer

Wappalyzer

Answer

Nmap

Answer

WhatWeb

Question 14

A penetration tester is conducting a vulnerability assessment and wants to minimize false positives. Which THREE actions should the tester take? (Select THREE.)

Accepted Answer

Verify findings manually. Option B is correct because manual verification of findings (e.g., confirming a vulnerability by exploiting it or inspecting the service banner) eliminates false positives that automated scanners often report due to signature mismatches or incomplete checks. For example, a scanner might flag a service as vulnerable based on version string alone, but manual testing can confirm whether the actual exploit conditions exist, such as checking for specific configuration flaws or patch levels.

Answer

Run the same scan multiple times

Answer

Ignore all high-severity findings initially

Question 15

A penetration tester is performing initial reconnaissance on a target domain. Which THREE sources can provide historical data about the target? (Select THREE.)

Accepted Answer

Wayback Machine. The Wayback Machine archives web pages, Pastebin may contain leaked historical data, and certificate transparency logs (crt.sh) provide historical certificate issuance data.

Answer

Shodan

Answer

Nmap