PT0-002 Reconnaissance and Enumeration Practice Test 6 — 15 Questions

Question 1

A penetration tester is performing active reconnaissance on a target network and wants to enumerate SNMP devices to gather system information. The tester uses snmpwalk with a common community string. Which community string is most likely to provide read-write access if misconfigured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

private. SNMP community strings are like passwords. 'public' is the default read-only community string, 'private' is the default read-write community string. 'internal' and 'manager' are less common defaults. The tester should try 'private' for potential read-write access.

Answer

public

Answer

internal

Answer

manager

Question 2

A penetration tester is conducting a vulnerability scan on a web server using Nikto. The scan report lists several findings, including a directory listing vulnerability and outdated server headers. Which type of scanner is Nikto?

Accepted Answer

Web server vulnerability scanner. Nikto is a web server scanner that tests for misconfigurations, outdated software, and common vulnerabilities. Nessus is a general vulnerability scanner, WPScan is for WordPress, and OpenVAS is also a general vulnerability scanner.

Answer

Network port scanner

Answer

WordPress vulnerability scanner

Answer

General vulnerability scanner

Question 3

During a web application penetration test, the tester wants to discover hidden directories and files on the target web server. Which tool is best suited for this task, and what technique does it use?

Accepted Answer

Gobuster - directory brute forcing. Directory enumeration tools like gobuster, dirbuster, and dirsearch use wordlist-based brute force to discover hidden directories and files. Gobuster is a common choice. Wappalyzer is for technology fingerprinting, whatweb is for web server identification, and curl is for HTTP requests but lacks directory brute force functionality.

Answer

Curl - manual HTTP requests

Answer

Whatweb - web server identification

Answer

Wappalyzer - technology fingerprinting

Question 4

A penetration tester is analyzing the output of a Nessus vulnerability scan and notices a critical vulnerability reported against a web server that is actually a false positive due to outdated plugin data. What is the best course of action for the tester?

Accepted Answer

Manually verify the vulnerability by testing it. A false positive due to outdated plugin data must be manually verified before any action is taken. The tester should use a tool like `curl` or a browser to send the exact request that Nessus simulated (e.g., an HTTP GET to a specific endpoint) and inspect the response headers or body to confirm whether the vulnerability actually exists. Only after manual validation can the tester decide to include, exclude, or note the finding in the report.

Answer

Accept the finding as accurate and include it in the report

Answer

Remove the finding from the report entirely

Answer

Ignore the finding because it's a false positive

Question 5

A penetration tester wants to query Certificate Transparency logs to find all SSL/TLS certificates issued for a target domain, which may reveal subdomains. Which tool or website is specifically designed for this purpose?

Accepted Answer

crt.sh. crt.sh is a website that queries Certificate Transparency logs and returns certificates for a domain, often revealing subdomains. Shodan and Censys also provide certificate data but crt.sh is focused on CT logs. Let's Encrypt is a CA, not a log query tool.

Answer

Censys

Answer

Let's Encrypt

Answer

Shodan

Question 6

A penetration tester is performing passive reconnaissance and wants to find historical versions of the target website, including old pages that may contain sensitive information. Which resource should the tester use?

Accepted Answer

Wayback Machine. The Wayback Machine (archive.org) archives historical snapshots of websites. Pastebin is for pasted text, Google dorks are for search queries, and Shodan is for device discovery.

Answer

Pastebin

Answer

Shodan

Answer

Google dorks

Question 7

During a penetration test, the tester runs a DNS zone transfer attempt against a target domain. The zone transfer fails. What is the most likely reason?

Accepted Answer

The DNS server is configured to deny zone transfers from unauthorized hosts. DNS zone transfers are typically restricted by default to authorized secondary DNS servers only. Misconfigured DNS servers might allow zone transfers from any host, but it's uncommon. The failure is likely due to security restrictions. The authoritative server is not necessarily offline, and the domain might not exist otherwise.

Answer

The DNS server is offline

Answer

The tester used the wrong tool

Answer

The domain does not exist

Question 8

A penetration tester is using theHarvester to gather email addresses associated with a target domain. The tool returns several email addresses. What is the primary limitation of using theHarvester for this purpose?

Accepted Answer

It only finds publicly available email addresses. theHarvester collects data from public sources, so its results are limited to what is publicly available. It may miss internal email addresses and can include outdated information. It does not require authentication, and it is not limited to Google only.

Answer

It requires authentication to the target's mail server

Answer

It only searches Google

Answer

It cannot find subdomains

Question 9

A penetration tester is performing active reconnaissance on a target network and wants to enumerate SNMP devices to gather system information. The tester uses snmpwalk with a common community string. Which community string is most likely to provide read-write access if misconfigured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

-O. -O enables OS detection, and -sC runs default scripts. -sV is version detection, -sS is SYN scan, -A includes all but is not necessary if only OS and scripts are needed.

Answer

-sV

Answer

-A

Answer

-sS

Question 10

A penetration tester is conducting a web application reconnaissance and wants to discover API endpoints and hidden parameters. Which three tools are most appropriate for this task? (Choose THREE.)

Accepted Answer

ffuf. ffuf (Fuzz Faster U Fool) is a high-performance fuzzing tool used to discover API endpoints and hidden parameters by brute-forcing URLs, headers, and POST data. It supports wordlist-based fuzzing and can be used to enumerate RESTful API paths by replacing placeholders in the target URL, making it ideal for web application reconnaissance.

Answer

Wappalyzer

Answer

Whatweb

Question 11

A penetration tester wants to perform passive reconnaissance on a target organization. Which two activities are considered passive reconnaissance? (Choose TWO.)

Accepted Answer

Searching Pastebin for leaked credentials. Searching Pastebin for leaked credentials involves collecting information from publicly accessible sources without directly interacting with the target's systems. This is a classic passive reconnaissance technique, as it relies on third-party data and does not generate any network traffic to the target organization.

Answer

Sending SNMP queries to a network device

Answer

Scanning ports with Nmap

Answer

Performing a DNS zone transfer attempt

Question 12

A penetration tester is performing passive reconnaissance on a target organization. Which of the following tools would be BEST for discovering subdomains and email addresses associated with the target domain without sending any packets to the target?

Accepted Answer

theHarvester. theHarvester is an OSINT tool that collects emails, subdomains, IPs, and URLs from public sources like search engines and PGP key servers without interacting with the target network.

Answer

WPScan

Answer

Nmap

Answer

snmpwalk

Question 13

During a penetration test, the tester discovers that the target web application uses a content delivery network (CDN) that hides the origin server's IP address. Which technique would BEST help identify the true IP address of the backend server?

Accepted Answer

Query certificate transparency logs via crt.sh for the domain. Certificate transparency logs, such as those queried via crt.sh, record SSL/TLS certificates issued for a domain. These certificates often include the origin server's IP address in the Subject Alternative Name (SAN) or other extensions, or they may reveal additional subdomains that point directly to the backend server, bypassing the CDN. This technique is effective because CDNs typically terminate SSL at the edge, but the certificate may still contain the true backend IP in historical or misconfigured entries.

Answer

Perform a DNS zone transfer against the target's domain

Answer

Run a full TCP port scan against the domain with Nmap

Answer

Use Shodan to search for the domain's SSL certificate hash

Question 14

A penetration tester is tasked with performing active reconnaissance on an internal network. The tester wants to identify live hosts and their open ports efficiently while minimizing noise. Which Nmap scan type should be used first to quickly discover which hosts are online?

Accepted Answer

nmap -sn 192.168.1.0/24. The `-sn` flag (ping scan) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default to determine if hosts are online without performing port scans. This minimizes network noise and quickly identifies live hosts on the subnet, which is the first step in active reconnaissance before deeper scanning.

Answer

nmap -sS -sV 192.168.1.0/24

Answer

nmap -A 192.168.1.0/24

Answer

nmap -sT 192.168.1.0/24

Question 15

A penetration tester has discovered a web application that appears to be built with WordPress. The tester wants to identify installed plugins, themes, and potential vulnerabilities without triggering intrusion detection systems. Which tool is BEST suited for this task?

Accepted Answer

WPScan. WPScan is a dedicated WordPress vulnerability scanner that can enumerate plugins, themes, users, and known vulnerabilities. It can be configured to use passive methods or throttle requests to avoid detection.

Answer

OpenVAS

Answer

Nikto

Answer

Gobuster