CCNA Reconnaissance and Enumeration Questions

ARP scanning with arp-scan is a Layer 2 host discovery technique that broadcasts ARP requests to an IP range and identifies live hosts by their ARP replies, which include MAC addresses. It is highly effective on the local subnet because ARP is a required protocol for IP communication and cannot be blocked by host-based firewalls, making it a reliable and stealthy way to map live systems without generating TCP or UDP traffic.

theHarvester is an OSINT tool that passively collects email addresses, subdomains, hostnames, and employee names from public sources such as Google, Bing, LinkedIn, and PGP key servers. It operates without sending any packets directly to the organization's own infrastructure, so it is undetectable and strictly non-intrusive. While it can optionally perform DNS brute forcing when run in active mode, its standard use aligns with passive reconnaissance efforts during the planning phase.

Manual verification involves a human analyst inspecting the actual service, configuration, or response to determine if the scanner's reported condition truly exists and is exploitable. For example, a scanner may flag a TLS version based on advertised ciphers, but manual testing (e.g., checking effective protocols via openssl or reviewing server config) can confirm if the issue is real or a misconfiguration that doesn't apply. This step is the gold standard for eliminating false positives because it applies context, logic, and exploitability assessment that automated tools lack.

The -sS option initiates a TCP SYN scan, often called a half-open scan, because it never completes the three-way handshake. The scanner sends a SYN packet and evaluates the response: a SYN/ACK marks the port as open, while an RST indicates closed. This technique is faster and less likely to be logged by application daemons, though it still requires raw packet privileges and can be detected by modern IDS/IPS.

The Wayback Machine, operated by the Internet Archive, captures and archives web pages at various points in time, allowing a penetration tester to retrieve old versions of a target's website. This is valuable for discovering historical content, previously exposed endpoints, old default pages, or configuration files that were later removed but may still be active or reveal security misconfigurations. Because these snapshots are timestamped, the tester can track changes over time and pinpoint when certain technologies or vulnerabilities were introduced. Unlike live tools, it provides a passive, non-intrusive source of historical data.

The default read-only community string in virtually all SNMPv1/v2c implementations is 'public.' It is a well-known, publicly documented string that attackers test first when discovering an SNMP service. Many devices ship with 'public' enabled, and leaving it unchanged is a critical misconfiguration. This ubiquity is why 'public' is the correct answer to the question.

theHarvester aggregates subdomains from public sources such as search engines, certificate transparency logs and OSINT datasets, so no packets reach the target's authoritative DNS servers. That satisfies the passive-reconnaissance constraint in the stem, unlike active brute-forcing or zone-transfer tools that query the domain directly.

WhatWeb is a dedicated website fingerprinting tool that uses a vast repository of plugins and signatures to identify the technologies powering a web application. It analyzes a wide range of signals, including HTTP headers, HTML source code, meta tags, cookies, script URLs, and inline JavaScript variables, to detect CMS platforms, web frameworks, JavaScript libraries, analytics tools, and even specific version numbers. WhatWeb assigns confidence ratings to each detection, allowing a penetration tester to accurately map the technology stack before selecting targeted attack techniques. This purpose-built nature and comprehensive signature coverage make WhatWeb the correct choice for website technology fingerprinting.

Netcat's verbose flag prints the service banner returned on connect, so nc -v target.com 22 reveals the SSH software and version string. It satisfies the banner-grabbing requirement directly on a chosen port without extra scripting.

JavaScript analysis is the correct approach because modern single-page applications often hard-code the API surface in their client-side code, such as REST URLs, GraphQL operation names, and route parameters. By examining network calls (fetch, XHR, WebSocket) and string literals, you can uncover undocumented endpoints that are not linked anywhere else in the HTML or robots.txt. This directly expands the attack surface and is a core web app recon technique.

Version detection is a post-scan enumeration step that sends specially crafted probes to open ports and analyzes the responses to determine the exact software and version, such as 'OpenSSH 8.2p1 Ubuntu 4ubuntu0.5' on port 22. This is typically performed using a tool like Nmap with the -sV flag, which may also try to infer service protocol and back-end. Unlike OS detection, it focuses on the application layer, and unlike vulnerability scanning, it does not evaluate security. The information gathered is essential for matching services to known CVEs and planning further exploitation.

The Wayback Machine, operated by the Internet Archive, automatically crawls and preserves dated snapshots of web pages across the internet. Penetration testers use it during passive reconnaissance to review a target's historical site versions, uncovering removed content, old file paths, or legacy technology. This makes it the definitive resource for viewing a website's past states without directly interacting with the target.

Dirsearch is an open-source, Python-based command-line tool explicitly built for directory brute-forcing and content discovery. It takes a wordlist of candidate path names, sends HTTP requests for each, and identifies valid resources by analyzing response status codes, sizes, and redirects. It supports recursive scanning, multi-threading, custom HTTP methods, and filters, making it a direct and effective answer to discovering hidden web paths.

WhatWeb is a web scanner designed to fingerprint web technologies, including server software, CMS, JavaScript libraries, and more. It sends requests to the target and analyzes responses to identify the technologies in use. It is non-intrusive and ideal for reconnaissance, making it the best choice for this scenario.

This is the correct Google dork for the objective. The site:example.com operator confines results to the target domain, filetype:pdf restricts results to PDF files, and the standalone keyword 'confidential' matches pages where that term appears within the indexed text of the PDF. Search engines like Google extract and index text content from PDFs, so this query effectively surfaces PDF documents on example.com that contain the word 'confidential,' which is exactly what a penetration tester would want to find during reconnaissance.

The 'Full and fast' profile in Nessus is the recommended comprehensive scan policy: it activates all plugins except those tagged as 'Denial of Service' or potentially disruptive, and it enables safe port scanning techniques. This ensures maximum vulnerability coverage across all plugin families (such as Windows, Linux, web applications, and databases) while still avoiding outright service disruption. It is the default starting point for a penetration test's vulnerability assessment phase.

This is the definition of a false positive: the scanner generates an alert based on a signature, version banner, or service fingerprint, but the claimed vulnerability does not actually exist in the target environment. For example, an automated scanner might flag a TLS configuration or an installed software version as vulnerable because the detection logic matches a generic CVE, even though the vendor has backported security patches or the vulnerable component is disabled. Such erroneous reports consume remediation resources and cause confusion, which is why manual verification is required before acting on scan results.

Certificate transparency logs are publicly published records of issued TLS certificates, so querying crt.sh never touches the target's infrastructure. This satisfies the stem's passive constraint, unlike active scanning or direct enumeration, which would generate traffic visible to the target's monitoring.

Feroxbuster is a fast, recursive content discovery tool written in Rust that uses brute-forcing with a wordlist to find directories and files on web servers. It is specifically effective for API discovery because it supports recursion, file extensions, status-code filtering, and concurrent requests, allowing a tester to uncover hidden REST endpoints such as /api/v1/users or /admin. Its performance and flexibility make it a top choice for active reconnaissance against web APIs.

WhatWeb is a dedicated web technology identification tool that queries the target and analyzes a vast range of indicators, including HTTP headers, meta tags, cookie names, HTML source, and JavaScript variables. Its plugin-based architecture matches thousands of known signatures and reports technologies with confidence levels, covering CMS, frameworks, libraries, and server software. This makes it the correct choice for the stated task of identifying technologies used by a website.

Configuring the scanner with valid, appropriately privileged credentials is what makes the scan authenticated and is the single most important technical setup step. Without the correct credentials, the scanner reverts to an unauthenticated posture, producing incomplete results that overlook missing patches, insecure registry entries, local privilege escalation paths, and other authentication-dependent vulnerabilities. The credentials must be stored securely, scoped to the engagement, and granted only the permissions needed to enumerate software versions and system configuration without causing unintended changes.

Gobuster is a specialized tool for brute-forcing directories, files, and DNS subdomains using user-supplied wordlists. It generates HTTP requests and evaluates response codes to identify valid paths, making it highly efficient for web application reconnaissance. The tool supports multiple modes (dir, dns, vhost), custom extensions, and threading options, giving testers precise control over enumeration depth and speed. This dedicated focus on resource discovery is exactly what the scenario requires.

WPScan is an open-source security scanner purpose-built for WordPress, included by default in distributions like Kali Linux. It enumerates the WordPress core version, installed themes and plugins, user accounts, and backup or configuration files, then cross-references findings against the WPScan API vulnerability database. This allows it to identify known vulnerabilities in plugins and themes that generic scanners often miss. Because the question asks for a tool specifically for evaluating WordPress security, WPScan is the correct answer.

The Wayback Machine is an archival service operated by the Internet Archive that crawls the web and stores full snapshots of websites over time, including HTML, CSS, JavaScript, and images. It allows OSINT researchers to query a URL and retrieve the exact version of a page as it appeared on a chosen date, making it the definitive resource for historical website content. Unlike certificate or network-focused search engines, it preserves the actual user-facing content rather than infrastructure metadata.