PT0-002 Information Gathering and Vulnerability Scanning Practice Test 6 — 15 Questions

Question 1

During a penetration test, the tester wants to gather information about the target organization's domain registration and contact details without sending any traffic to the target. Which OSINT source should the tester use first?

Accepted Answer

WHOIS. WHOIS lookups provide registration details for domains, including administrative contacts, name servers, and expiration dates, without sending traffic to the target. Shodan searches for internet-connected devices, Censys provides certificates and host information, and crt.sh shows certificate transparency logs.

Answer

Shodan

Answer

crt.sh

Answer

Censys

Question 2

A penetration tester is conducting passive reconnaissance on a target organization. The tester wants to discover subdomains and associated email addresses without directly interacting with the target's infrastructure. Which combination of tools and sources would be most effective for this task?

Accepted Answer

theHarvester with Shodan and Google dorks. theHarvester is an OSINT tool that can gather emails, subdomains, and other data from public sources like search engines, PGP key servers, and the Shodan database. It performs passive collection. Maltego can also be used but requires more setup. Shodan and Google dorks are specific searches but theHarvester automates multiple sources.

Answer

Wireshark capturing network traffic

Answer

Nikto scanning the web server

Answer

Nmap with subdomain bruteforce

Question 3

During a penetration test, the tester performs a SYN scan with Nmap on a target network. The results show that port 443 is open on a web server. The tester then runs a service version detection scan and discovers the server is running Apache 2.4.41. Which Nmap flags were used in sequence?

Accepted Answer

nmap -sS then nmap -sV. The tester first performed a SYN scan with -sS to identify open ports, then used -sV for service version detection. -sC runs default scripts, -O is for OS detection, and -A enables aggressive scanning (includes OS detection, version detection, script scanning, and traceroute).

Answer

nmap -A then nmap -O

Answer

nmap -sV then nmap -sS

Answer

nmap -sS then nmap -sC

Question 4

A penetration tester is using Nmap to perform host discovery on a target network 192.168.1.0/24. The tester wants to identify live hosts without scanning ports. Which Nmap command should be used?

Accepted Answer

nmap -sn 192.168.1.0/24. Option D is correct because the `-sn` flag in Nmap performs a ping sweep (host discovery) without scanning any ports. It sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default to determine which hosts are alive on the 192.168.1.0/24 network, making it the ideal choice for identifying live hosts without port scanning.

Answer

nmap -A 192.168.1.0/24

Answer

nmap -sS 192.168.1.0/24

Answer

nmap -sV 192.168.1.0/24

Question 5

A penetration tester is performing active reconnaissance on a target network and wants to enumerate SNMP devices to gather system information. The tester uses snmpwalk with a common community string. Which community string is most likely to provide read-write access if misconfigured?

Accepted Answer

private. SNMP community strings are like passwords. 'public' is the default read-only community string, 'private' is the default read-write community string. 'internal' and 'manager' are less common defaults. The tester should try 'private' for potential read-write access.

Answer

public

Answer

internal

Answer

manager

Question 6

A penetration tester is conducting a vulnerability scan on a web server using Nikto. The scan report lists several findings, including a directory listing vulnerability and outdated server headers. Which type of scanner is Nikto?

Accepted Answer

Web server vulnerability scanner. Nikto is a web server scanner that tests for misconfigurations, outdated software, and common vulnerabilities. Nessus is a general vulnerability scanner, WPScan is for WordPress, and OpenVAS is also a general vulnerability scanner.

Answer

Network port scanner

Answer

WordPress vulnerability scanner

Answer

General vulnerability scanner

Question 7

During a web application penetration test, the tester wants to discover hidden directories and files on the target web server. Which tool is best suited for this task, and what technique does it use?

Accepted Answer

Gobuster - directory brute forcing. Directory enumeration tools like gobuster, dirbuster, and dirsearch use wordlist-based brute force to discover hidden directories and files. Gobuster is a common choice. Wappalyzer is for technology fingerprinting, whatweb is for web server identification, and curl is for HTTP requests but lacks directory brute force functionality.

Answer

Curl - manual HTTP requests

Answer

Whatweb - web server identification

Answer

Wappalyzer - technology fingerprinting

Question 8

A penetration tester is analyzing the output of a Nessus vulnerability scan and notices a critical vulnerability reported against a web server that is actually a false positive due to outdated plugin data. What is the best course of action for the tester?

Accepted Answer

Manually verify the vulnerability by testing it. Option C is correct because a false positive due to outdated plugin data must be manually verified before any action is taken. The tester should use a tool like `curl` or a browser to send the exact request that Nessus simulated (e.g., an HTTP GET to a specific endpoint) and inspect the response headers or body to confirm whether the vulnerability actually exists. Only after manual validation can the tester decide to include, exclude, or note the finding in the report.

Answer

Accept the finding as accurate and include it in the report

Answer

Remove the finding from the report entirely

Answer

Ignore the finding because it's a false positive

Question 9

A penetration tester wants to query Certificate Transparency logs to find all SSL/TLS certificates issued for a target domain, which may reveal subdomains. Which tool or website is specifically designed for this purpose?

Accepted Answer

crt.sh. crt.sh is a website that queries Certificate Transparency logs and returns certificates for a domain, often revealing subdomains. Shodan and Censys also provide certificate data but crt.sh is focused on CT logs. Let's Encrypt is a CA, not a log query tool.

Answer

Censys

Answer

Let's Encrypt

Answer

Shodan

Question 10

A penetration tester is performing passive reconnaissance and wants to find historical versions of the target website, including old pages that may contain sensitive information. Which resource should the tester use?

Accepted Answer

Wayback Machine. The Wayback Machine (archive.org) archives historical snapshots of websites. Pastebin is for pasted text, Google dorks are for search queries, and Shodan is for device discovery.

Answer

Pastebin

Answer

Shodan

Answer

Google dorks

Question 11

During a penetration test, the tester runs a DNS zone transfer attempt against a target domain. The zone transfer fails. What is the most likely reason?

Accepted Answer

The DNS server is configured to deny zone transfers from unauthorized hosts. DNS zone transfers are typically restricted by default to authorized secondary DNS servers only. Misconfigured DNS servers might allow zone transfers from any host, but it's uncommon. The failure is likely due to security restrictions. The authoritative server is not necessarily offline, and the domain might not exist otherwise.

Answer

The DNS server is offline

Answer

The tester used the wrong tool

Answer

The domain does not exist

Question 12

A penetration tester is using theHarvester to gather email addresses associated with a target domain. The tool returns several email addresses. What is the primary limitation of using theHarvester for this purpose?

Accepted Answer

It only finds publicly available email addresses. theHarvester collects data from public sources, so its results are limited to what is publicly available. It may miss internal email addresses and can include outdated information. It does not require authentication, and it is not limited to Google only.

Answer

It requires authentication to the target's mail server

Answer

It only searches Google

Answer

It cannot find subdomains

Question 13

A penetration tester is performing active reconnaissance on a target network and wants to use Nmap to identify operating systems and run default scripts against discovered services. Which two Nmap options should the tester include? (Choose TWO.)

Accepted Answer

-O. -O enables OS detection, and -sC runs default scripts. -sV is version detection, -sS is SYN scan, -A includes all but is not necessary if only OS and scripts are needed.

Answer

-sV

Answer

-A

Answer

-sS

Question 14

A penetration tester is conducting a web application reconnaissance and wants to discover API endpoints and hidden parameters. Which three tools are most appropriate for this task? (Choose THREE.)

Accepted Answer

ffuf. ffuf (Fuzz Faster U Fool) is a high-performance fuzzing tool used to discover API endpoints and hidden parameters by brute-forcing URLs, headers, and POST data. It supports wordlist-based fuzzing and can be used to enumerate RESTful API paths by replacing placeholders in the target URL, making it ideal for web application reconnaissance.

Answer

Wappalyzer

Answer

Whatweb

Question 15

A penetration tester wants to perform passive reconnaissance on a target organization. Which two activities are considered passive reconnaissance? (Choose TWO.)

Accepted Answer

Searching Pastebin for leaked credentials. Option A is correct because searching Pastebin for leaked credentials involves collecting information from publicly accessible sources without directly interacting with the target's systems. This is a classic passive reconnaissance technique, as it relies on third-party data and does not generate any network traffic to the target organization.

Answer

Sending SNMP queries to a network device

Answer

Scanning ports with Nmap

Answer

Performing a DNS zone transfer attempt