PT0-002 Information Gathering and Vulnerability Scanning Practice Test 7 — 15 Questions

Question 1

A penetration tester is performing passive reconnaissance on a target organization. Which of the following tools would be BEST for discovering subdomains and email addresses associated with the target domain without sending any packets to the target?

Accepted Answer

theHarvester. theHarvester is an OSINT tool that collects emails, subdomains, IPs, and URLs from public sources like search engines and PGP key servers without interacting with the target network.

Answer

WPScan

Answer

Nmap

Answer

snmpwalk

Question 2

During a penetration test, the tester discovers that the target web application uses a content delivery network (CDN) that hides the origin server's IP address. Which technique would BEST help identify the true IP address of the backend server?

Accepted Answer

Query certificate transparency logs via crt.sh for the domain. Certificate transparency logs, such as those queried via crt.sh, record SSL/TLS certificates issued for a domain. These certificates often include the origin server's IP address in the Subject Alternative Name (SAN) or other extensions, or they may reveal additional subdomains that point directly to the backend server, bypassing the CDN. This technique is effective because CDNs typically terminate SSL at the edge, but the certificate may still contain the true backend IP in historical or misconfigured entries.

Answer

Perform a DNS zone transfer against the target's domain

Answer

Run a full TCP port scan against the domain with Nmap

Answer

Use Shodan to search for the domain's SSL certificate hash

Question 3

A penetration tester is tasked with performing active reconnaissance on an internal network. The tester wants to identify live hosts and their open ports efficiently while minimizing noise. Which Nmap scan type should be used first to quickly discover which hosts are online?

Accepted Answer

nmap -sn 192.168.1.0/24. Option C is correct because the `-sn` flag (ping scan) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default to determine if hosts are online without performing port scans. This minimizes network noise and quickly identifies live hosts on the subnet, which is the first step in active reconnaissance before deeper scanning.

Answer

nmap -sS -sV 192.168.1.0/24

Answer

nmap -A 192.168.1.0/24

Answer

nmap -sT 192.168.1.0/24

Question 4

A penetration tester has discovered a web application that appears to be built with WordPress. The tester wants to identify installed plugins, themes, and potential vulnerabilities without triggering intrusion detection systems. Which tool is BEST suited for this task?

Accepted Answer

WPScan. WPScan is a dedicated WordPress vulnerability scanner that can enumerate plugins, themes, users, and known vulnerabilities. It can be configured to use passive methods or throttle requests to avoid detection.

Answer

OpenVAS

Answer

Nikto

Answer

Gobuster

Question 5

While performing vulnerability scanning with Nessus, a penetration tester notices that several high-severity vulnerabilities are reported for a web server, but manual verification shows the server is not vulnerable. What is the MOST likely cause of this discrepancy?

Accepted Answer

The scanner is reporting false positives due to inaccurate version detection. Nessus performs version-based detection by analyzing server banners and HTTP response headers. If the web server's software version string is outdated or misconfigured, the scanner may flag vulnerabilities that do not actually exist in the patched or custom-compiled version. This is a classic false positive scenario where the scanner relies on version matching rather than actual exploit verification.

Answer

The scanner used unauthenticated scans, missing the actual vulnerabilities

Answer

The scanner configuration excluded necessary plugins for accurate testing

Answer

The target server is behind a load balancer that modifies responses

Question 6

A penetration tester wants to use Google dorking to find publicly accessible documents containing sensitive information on a target domain 'example.com'. Which Google dork would be MOST appropriate to locate PDF files with the word 'confidential'?

Accepted Answer

site:example.com filetype:pdf confidential. Option C is correct because the Google dork 'site:example.com filetype:pdf confidential' combines the site restriction to the target domain, the filetype filter for PDFs, and the keyword 'confidential' to search for PDF documents containing that word. This directly matches the requirement to locate publicly accessible PDF files with the word 'confidential' on example.com.

Answer

site:example.com intitle:confidential pdf

Answer

filetype:pdf site:example.com password

Answer

site:example.com inurl:pdf confidential

Question 7

During a penetration test, the tester is using Gobuster to enumerate directories on a web server. Which flag would the tester use to specify a list of file extensions to append to each word in the wordlist for discovering files like 'admin.php' or 'config.bak'?

Accepted Answer

-x. The -x flag in Gobuster allows specifying extensions to append to each word during directory/file bruteforcing, enabling discovery of files with those extensions.

Answer

-e

Answer

-w

Answer

-t

Question 8

A penetration tester is performing a security assessment of a network that uses SNMP. The tester successfully connects to a device using the community string 'public'. Which tool would the tester MOST likely use to enumerate the entire Management Information Base (MIB) tree to extract system information, running processes, and network interfaces?

Accepted Answer

snmpwalk. snmpwalk is the correct tool because it uses SNMP GETNEXT requests to systematically traverse the entire Management Information Base (MIB) tree, retrieving all OID values from a device. Given the tester already has a valid community string ('public'), snmpwalk can extract detailed system information, running processes, and network interfaces without needing to guess or brute-force credentials.

Answer

snmp-check

Answer

MIB Browser

Answer

Nmap with snmp-brute script

Question 9

A penetration tester is conducting passive reconnaissance and wants to find historical snapshots of a target website to identify past vulnerabilities or hidden endpoints. Which online service should the tester use?

Accepted Answer

Wayback Machine. The Wayback Machine (archive.org) is the correct choice because it archives historical snapshots of websites, allowing a penetration tester to review past versions of a target site to identify previously exposed vulnerabilities, hidden endpoints, or outdated configurations. This aligns with passive reconnaissance, as the tester does not interact directly with the live target.

Answer

Shodan

Answer

Censys

Answer

Pastebin

Question 10

A penetration tester is performing active reconnaissance on a web application and wants to discover hidden API endpoints. Which TWO tools are BEST suited for this task? (Select TWO.)

Accepted Answer

Feroxbuster. Gobuster can be used to bruteforce directories and files, including API paths. Feroxbuster is a similar tool written in Rust that is faster and supports recursion. Both are effective for API endpoint discovery.

Answer

Wappalyzer

Answer

Nikto

Answer

theHarvester

Question 11

A penetration tester is tasked with performing a DNS enumeration of a target domain to discover subdomains. Which THREE tools are commonly used for subdomain bruteforcing? (Select THREE.)

Accepted Answer

amass. Amass is correct because it is a dedicated subdomain enumeration tool that performs bruteforcing via DNS queries, using wordlists and recursive resolution to discover subdomains. It integrates with multiple data sources and supports active bruteforcing techniques against target domains.

Answer

sublist3r

Answer

gobuster dns

Question 12

A penetration tester is analyzing a web application's JavaScript files for hardcoded secrets and API endpoints. Which THREE techniques or tools are MOST effective for this purpose? (Select THREE.)

Accepted Answer

Using LinkFinder to extract endpoints from JavaScript. LinkFinder is a Python tool specifically designed to extract API endpoints and URLs from JavaScript files by parsing the JS content and using regular expressions to identify potential endpoints. This makes it highly effective for discovering hidden or undocumented API routes that may be exposed in client-side code.

Answer

Using Wappalyzer to identify frameworks

Answer

Using Gobuster to bruteforce directories

Question 13

A penetration tester is conducting a vulnerability scan of a Linux server using OpenVAS. Which TWO scan configurations would provide the MOST comprehensive results? (Select TWO.)

Accepted Answer

Scan using the 'Full and fast' configuration. Authenticated scans with credentials allow the scanner to log in and check for missing patches, misconfigurations, and vulnerabilities that are not visible externally. Full and fast scan configurations are typical for comprehensive coverage.

Answer

Scan using only the 'Discovery' category

Answer

Scan using the 'Denial of Service' configuration

Answer

Unauthenticated scan with default settings

Question 14

During a web application penetration test, the tester wants to discover hidden parameters that the application accepts. Which THREE tools are BEST suited for parameter bruteforcing? (Select THREE.)

Accepted Answer

Arjun. Arjun is specifically designed to discover hidden HTTP parameters by performing parameter bruteforcing using a wordlist. It sends requests with various parameter names and analyzes responses to identify which ones are accepted by the web application, making it a dedicated tool for this task.

Answer

WPScan

Answer

Nikto

Question 15

A penetration tester is performing reconnaissance on a target network and wants to identify all live hosts without sending many packets. Which TWO techniques are MOST effective for host discovery in a local subnet? (Select TWO.)

Accepted Answer

ARP scan using arp-scan. ARP scan using arp-scan is effective because it sends ARP requests to every IP in the subnet and listens for ARP replies. Since ARP is a Layer 2 protocol, it does not require IP-level responses and works even if hosts block ICMP or TCP probes. This technique is extremely fast and generates minimal traffic, making it ideal for local subnet host discovery.

Answer

TCP SYN scan on port 80

Answer

UDP scan on port 161

Answer

DNS zone transfer