PT0-002 Reconnaissance and Enumeration Practice Test 5 — 15 Questions

Question 1

A penetration tester is using Google dorks to find sensitive information about a target organization. Which search operator would help the tester find PDF files containing the word 'confidential' on the target's website?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

site:target.com filetype:pdf intext:confidential. The filetype operator filters results by file extension (e.g., pdf), and the intext operator searches for the specified text within the page content.

Answer

site:target.com ext:pdf confidential

Answer

site:target.com intitle:confidential pdf

Answer

inurl:target.com filetype:pdf confidential

Question 2

During a penetration test, a tester wants to discover all live hosts on a subnet without performing a full port scan. Which Nmap command is most appropriate for this purpose?

Accepted Answer

nmap -sn 192.168.1.0/24. The -sn flag performs a ping sweep (host discovery) without port scanning, which is the standard method to discover live hosts on a subnet efficiently.

Answer

nmap -sS 192.168.1.0/24

Answer

nmap -O 192.168.1.0/24

Answer

nmap -A 192.168.1.0/24

Question 3

A penetration tester is assessing a web application and wants to identify hidden parameters that the application accepts. Which tool is specifically designed for parameter discovery?

Accepted Answer

Arjun. Arjun is a tool for discovering HTTP parameters by brute-forcing common parameter names and analyzing responses for changes, making it suitable for parameter discovery.

Answer

WPScan

Answer

Nikto

Answer

Gobuster

Question 4

A penetration tester is performing SNMP enumeration on a target network. Which command would likely be used to extract information from a device with the community string 'public'?

Accepted Answer

snmpwalk -v 2c -c public target_ip. snmpwalk is a standard tool for retrieving a subtree of SNMP MIB data, often used for enumeration with the -v 2c version and -c community string.

Answer

snmpget -v 2c -c public target_ip

Answer

snmpset -v 2c -c public target_ip

Answer

snmpbulkwalk -v 2c -c public target_ip

Question 5

Which of the following tools is most commonly used for passive reconnaissance by querying certificate transparency logs to discover subdomains?

Accepted Answer

crt.sh. crt.sh is a certificate transparency log search tool that can be used to find subdomains by querying SSL/TLS certificates issued for a domain.

Answer

Censys

Answer

theHarvester

Answer

Shodan

Question 6

A penetration tester wants to perform a directory brute-force attack against a web server to discover hidden files and directories. Which tool is best suited for this task?

Accepted Answer

Gobuster. Gobuster is a popular tool for directory and file brute-forcing using wordlists, making it ideal for discovering hidden resources on web servers.

Answer

WPScan

Answer

Nikto

Answer

Nmap

Question 7

During a penetration test, a tester uses the Wayback Machine to review historical versions of the target's website. What is the primary benefit of this activity?

Accepted Answer

It reveals old web pages that may contain sensitive information or forgotten endpoints. The Wayback Machine archives historical snapshots of web pages, which can reveal old files, endpoints, or sensitive information that may have been removed but are still accessible on the live site.

Answer

It bypasses the target's WAF

Answer

It provides real-time vulnerability data

Answer

It performs a live vulnerability scan

Question 8

A penetration tester is using Nmap to perform an aggressive scan of a target. Which command combines OS detection, version detection, script scanning, and traceroute?

Accepted Answer

nmap -A target. The -A flag enables aggressive scanning which includes OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute (--traceroute).

Answer

nmap -sV -O target

Answer

nmap -sC -O target

Answer

nmap -T4 -sV target

Question 9

A penetration tester is performing active reconnaissance on a target web application. Which TWO tools are specifically designed for directory and file enumeration? (Select TWO.)

Accepted Answer

Feroxbuster. Gobuster and Feroxbuster are both tools specifically designed for directory and file brute-forcing on web servers.

Answer

Wappalyzer

Answer

Nmap

Answer

WhatWeb

Question 10

A penetration tester is conducting a vulnerability assessment and wants to minimize false positives. Which THREE actions should the tester take? (Select THREE.)

Accepted Answer

Verify findings manually. Manual verification of findings (e.g., confirming a vulnerability by exploiting it or inspecting the service banner) eliminates false positives that automated scanners often report due to signature mismatches or incomplete checks. For example, a scanner might flag a service as vulnerable based on version string alone, but manual testing can confirm whether the actual exploit conditions exist, such as checking for specific configuration flaws or patch levels.

Answer

Run the same scan multiple times

Answer

Ignore all high-severity findings initially

Question 11

A penetration tester is performing initial reconnaissance on a target domain. Which THREE sources can provide historical data about the target? (Select THREE.)

Accepted Answer

Wayback Machine. The Wayback Machine archives web pages, Pastebin may contain leaked historical data, and certificate transparency logs (crt.sh) provide historical certificate issuance data.

Answer

Shodan

Answer

Nmap

Question 12

During a penetration test, the tester wants to gather information about the target organization's domain registration and contact details without sending any traffic to the target. Which OSINT source should the tester use first?

Accepted Answer

WHOIS. WHOIS lookups provide registration details for domains, including administrative contacts, name servers, and expiration dates, without sending traffic to the target. Shodan searches for internet-connected devices, Censys provides certificates and host information, and crt.sh shows certificate transparency logs.

Answer

Shodan

Answer

crt.sh

Answer

Censys

Question 13

A penetration tester is conducting passive reconnaissance on a target organization. The tester wants to discover subdomains and associated email addresses without directly interacting with the target's infrastructure. Which combination of tools and sources would be most effective for this task?

Accepted Answer

theHarvester with Shodan and Google dorks. theHarvester is an OSINT tool that can gather emails, subdomains, and other data from public sources like search engines, PGP key servers, and the Shodan database. It performs passive collection. Maltego can also be used but requires more setup. Shodan and Google dorks are specific searches but theHarvester automates multiple sources.

Answer

Wireshark capturing network traffic

Answer

Nikto scanning the web server

Answer

Nmap with subdomain bruteforce

Question 14

During a penetration test, the tester performs a SYN scan with Nmap on a target network. The results show that port 443 is open on a web server. The tester then runs a service version detection scan and discovers the server is running Apache 2.4.41. Which Nmap flags were used in sequence?

Accepted Answer

nmap -sS then nmap -sV. The tester first performed a SYN scan with -sS to identify open ports, then used -sV for service version detection. -sC runs default scripts, -O is for OS detection, and -A enables aggressive scanning (includes OS detection, version detection, script scanning, and traceroute).

Answer

nmap -A then nmap -O

Answer

nmap -sV then nmap -sS

Answer

nmap -sS then nmap -sC

Question 15

A penetration tester is using Nmap to perform host discovery on a target network 192.168.1.0/24. The tester wants to identify live hosts without scanning ports. Which Nmap command should be used?

Accepted Answer

nmap -sn 192.168.1.0/24. The `-sn` flag in Nmap performs a ping sweep (host discovery) without scanning any ports. It sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default to determine which hosts are alive on the 192.168.1.0/24 network, making it the ideal choice for identifying live hosts without port scanning.

Answer

nmap -A 192.168.1.0/24

Answer

nmap -sS 192.168.1.0/24

Answer

nmap -sV 192.168.1.0/24