PT0-002 Reconnaissance and Enumeration Practice Test 7 — 15 Questions

Question 1

While performing vulnerability scanning with Nessus, a penetration tester notices that several high-severity vulnerabilities are reported for a web server, but manual verification shows the server is not vulnerable. What is the MOST likely cause of this discrepancy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The scanner is reporting false positives due to inaccurate version detection. Nessus performs version-based detection by analyzing server banners and HTTP response headers. If the web server's software version string is outdated or misconfigured, the scanner may flag vulnerabilities that do not actually exist in the patched or custom-compiled version. This is a classic false positive scenario where the scanner relies on version matching rather than actual exploit verification.

Answer

The scanner used unauthenticated scans, missing the actual vulnerabilities

Answer

The scanner configuration excluded necessary plugins for accurate testing

Answer

The target server is behind a load balancer that modifies responses

Question 2

A penetration tester wants to use Google dorking to find publicly accessible documents containing sensitive information on a target domain 'example.com'. Which Google dork would be MOST appropriate to locate PDF files with the word 'confidential'?

Accepted Answer

site:example.com filetype:pdf confidential. The Google dork 'site:example.com filetype:pdf confidential' combines the site restriction to the target domain, the filetype filter for PDFs, and the keyword 'confidential' to search for PDF documents containing that word. This directly matches the requirement to locate publicly accessible PDF files with the word 'confidential' on example.com.

Answer

site:example.com intitle:confidential pdf

Answer

filetype:pdf site:example.com password

Answer

site:example.com inurl:pdf confidential

Question 3

During a penetration test, the tester is using Gobuster to enumerate directories on a web server. Which flag would the tester use to specify a list of file extensions to append to each word in the wordlist for discovering files like 'admin.php' or 'config.bak'?

Accepted Answer

-x. The -x flag in Gobuster allows specifying extensions to append to each word during directory/file bruteforcing, enabling discovery of files with those extensions.

Answer

-e

Answer

-w

Answer

-t

Question 4

A penetration tester is performing a security assessment of a network that uses SNMP. The tester successfully connects to a device using the community string 'public'. Which tool would the tester MOST likely use to enumerate the entire Management Information Base (MIB) tree to extract system information, running processes, and network interfaces?

Accepted Answer

snmpwalk. snmpwalk is the correct tool because it uses SNMP GETNEXT requests to systematically traverse the entire Management Information Base (MIB) tree, retrieving all OID values from a device. Given the tester already has a valid community string ('public'), snmpwalk can extract detailed system information, running processes, and network interfaces without needing to guess or brute-force credentials.

Answer

snmp-check

Answer

MIB Browser

Answer

Nmap with snmp-brute script

Question 5

A penetration tester is conducting passive reconnaissance and wants to find historical snapshots of a target website to identify past vulnerabilities or hidden endpoints. Which online service should the tester use?

Accepted Answer

Wayback Machine. The Wayback Machine (archive.org) is the correct choice because it archives historical snapshots of websites, allowing a penetration tester to review past versions of a target site to identify previously exposed vulnerabilities, hidden endpoints, or outdated configurations. This aligns with passive reconnaissance, as the tester does not interact directly with the live target.

Answer

Shodan

Answer

Censys

Answer

Pastebin

Question 6

A penetration tester is performing active reconnaissance on a web application and wants to discover hidden API endpoints. Which TWO tools are BEST suited for this task? (Select TWO.)

Accepted Answer

Feroxbuster. Gobuster can be used to bruteforce directories and files, including API paths. Feroxbuster is a similar tool written in Rust that is faster and supports recursion. Both are effective for API endpoint discovery.

Answer

Wappalyzer

Answer

Nikto

Answer

theHarvester

Question 7

A penetration tester is tasked with performing a DNS enumeration of a target domain to discover subdomains. Which THREE tools are commonly used for subdomain bruteforcing? (Select THREE.)

Accepted Answer

amass. Amass is correct because it is a dedicated subdomain enumeration tool that performs bruteforcing via DNS queries, using wordlists and recursive resolution to discover subdomains. It integrates with multiple data sources and supports active bruteforcing techniques against target domains.

Answer

sublist3r

Answer

gobuster dns

Question 8

A penetration tester is analyzing a web application's JavaScript files for hardcoded secrets and API endpoints. Which THREE techniques or tools are MOST effective for this purpose? (Select THREE.)

Accepted Answer

Using LinkFinder to extract endpoints from JavaScript. LinkFinder is a Python tool specifically designed to extract API endpoints and URLs from JavaScript files by parsing the JS content and using regular expressions to identify potential endpoints. This makes it highly effective for discovering hidden or undocumented API routes that may be exposed in client-side code.

Answer

Using Wappalyzer to identify frameworks

Answer

Using Gobuster to bruteforce directories

Question 9

A penetration tester is conducting a vulnerability scan of a Linux server using OpenVAS. Which TWO scan configurations would provide the MOST comprehensive results? (Select TWO.)

Accepted Answer

Scan using the 'Full and fast' configuration. Authenticated scans with credentials allow the scanner to log in and check for missing patches, misconfigurations, and vulnerabilities that are not visible externally. Full and fast scan configurations are typical for comprehensive coverage.

Answer

Scan using only the 'Discovery' category

Answer

Scan using the 'Denial of Service' configuration

Answer

Unauthenticated scan with default settings

Question 10

During a web application penetration test, the tester wants to discover hidden parameters that the application accepts. Which THREE tools are BEST suited for parameter bruteforcing? (Select THREE.)

Accepted Answer

Arjun. Arjun is specifically designed to discover hidden HTTP parameters by performing parameter bruteforcing using a wordlist. It sends requests with various parameter names and analyzes responses to identify which ones are accepted by the web application, making it a dedicated tool for this task.

Answer

WPScan

Answer

Nikto

Question 11

A penetration tester is performing reconnaissance on a target network and wants to identify all live hosts without sending many packets. Which TWO techniques are MOST effective for host discovery in a local subnet? (Select TWO.)

Accepted Answer

ARP scan using arp-scan. ARP scan using arp-scan is effective because it sends ARP requests to every IP in the subnet and listens for ARP replies. Since ARP is a Layer 2 protocol, it does not require IP-level responses and works even if hosts block ICMP or TCP probes. This technique is extremely fast and generates minimal traffic, making it ideal for local subnet host discovery.

Answer

TCP SYN scan on port 80

Answer

UDP scan on port 161

Answer

DNS zone transfer

Question 12

A penetration tester is conducting passive reconnaissance against a target organization. Which TWO of the following techniques would be most appropriate for gathering information about the organization's infrastructure and employees without directly interacting with the target's systems?

Accepted Answer

Performing WHOIS lookups to find domain registration details. WHOIS lookups and LinkedIn searches are passive reconnaissance techniques as they leverage publicly available databases and do not send any packets to the target's own systems. DNS enumeration (option A) typically involves direct queries to the target's DNS servers, which may be logged. Shodan (option B) aggregates data from active scans and querying its API could expose the tester's IP, though it can be considered semi-passive. Netcraft (option E) also relies on active data collection. Therefore, the two most appropriate passive techniques are C (WHOIS) and D (LinkedIn).

Answer

Using DNS enumeration tools like nslookup or dig

Answer

Querying Shodan for open ports on the target's IP range

Answer

Reviewing the target's website on Netcraft

Question 13

During an active reconnaissance phase, a penetration tester runs Nmap against a target and obtains the following results: Host is up, ports 22, 80, and 443 are open. The tester then runs a vulnerability scan using Nessus with unauthenticated credentials. Which THREE of the following issues should the tester be most concerned about regarding the accuracy and completeness of the Nessus scan results?

Accepted Answer

Nessus might miss vulnerabilities that require authenticated access to detect. Unauthenticated scans often miss vulnerabilities that require authentication, may produce false positives due to banner-based detection, and may not detect certain services that rely on authenticated checks. Nmap results are typically accurate for open ports. Missing open ports due to firewall is possible but less likely with Nmap SYN scan.

Answer

The Nmap results may have false positives for open ports

Answer

Nessus will only scan the top 1000 ports by default, potentially missing services on higher ports

Question 14

A penetration tester is performing web application reconnaissance. The tester wants to discover hidden directories and files, identify the technologies used, and find API endpoints. Which THREE of the following tools are best suited for these tasks?

Accepted Answer

Gobuster. Gobuster is a tool that performs directory/file brute-forcing using wordlists, making it ideal for discovering hidden directories and files. It can also be used to enumerate DNS subdomains and virtual hosts, directly supporting the task of finding hidden resources on a web server.

Answer

Nikto

Answer

Burp Suite

Question 15

During a penetration test, you want to discover API endpoints and hidden parameters in a web application. Which tool combination is most effective for this task?

Accepted Answer

Arjun and ffuf. Arjun is specifically designed for parameter discovery, while ffuf can be used to bruteforce both directories and parameters. Together they effectively find API endpoints and parameters. gobuster is for directory/file enumeration, not specifically for parameters.

Answer

Wappalyzer and curl

Answer

WhatWeb and theHarvester

Answer

Gobuster and Nikto