CCNA Ptp Recon Scanning Questions

crt.sh is a website that queries Certificate Transparency logs and returns certificates for a domain, often revealing subdomains. Shodan and Censys also provide certificate data but crt.sh is focused on CT logs. Let's Encrypt is a CA, not a log query tool.

WPScan is a dedicated WordPress security scanner that enumerates WordPress-specific vulnerabilities, including outdated plugins, themes, and weak passwords via XML-RPC brute-force testing. It uses the WordPress vulnerability database (wpvulndb.com) to match installed versions against known CVEs, making it the correct tool for this targeted task.

A SYN scan (nmap -sS) sends SYN packets and analyzes responses without completing the handshake, making it stealthier than a full connect scan.

LinkFinder is a Python tool specifically designed to extract API endpoints and URLs from JavaScript files by parsing the JS content and using regular expressions to identify potential endpoints. This makes it highly effective for discovering hidden or undocumented API routes that may be exposed in client-side code.

theHarvester is a popular OSINT tool used to gather emails, subdomains, IPs, and employee names from public sources like search engines, PGP key servers, and social networks.

Option B is correct because the `-sn` flag (ping scan) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests to discover live hosts without performing port scans or service detection, minimizing traffic and intrusiveness. This meets the requirement of discovering all live hosts on a subnet efficiently.

theHarvester is designed for passive OSINT gathering of emails, subdomains, IPs, etc. Maltego is also OSINT but more graph-oriented; theHarvester is specifically for email/subdomain enumeration.

-O enables OS detection, and -sC runs default scripts. -sV is version detection, -sS is SYN scan, -A includes all but is not necessary if only OS and scripts are needed.

The -sn flag in Nmap performs a ping sweep (host discovery) without port scanning, sending ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default.

WHOIS lookups provide registration details for domains, including administrative contacts, name servers, and expiration dates, without sending traffic to the target. Shodan searches for internet-connected devices, Censys provides certificates and host information, and crt.sh shows certificate transparency logs.

SYN scan (-sS) is considered stealthy because it does not complete the TCP handshake, reducing the likelihood of being logged compared to a full connect scan.

theHarvester is an OSINT tool designed to gather emails, subdomains, IPs, and employee names from public sources like search engines and social media. Maltego is more for relationship mapping, Shodan for internet-facing devices, and Censys for certificate and network data.

Arjun is specifically designed for parameter discovery, while ffuf can be used to bruteforce both directories and parameters. Together they effectively find API endpoints and parameters. gobuster is for directory/file enumeration, not specifically for parameters.

theHarvester is an OSINT tool that collects emails, subdomains, IPs, and URLs from public sources like search engines and PGP key servers without interacting with the target network.

A false positive is when a scanner reports a vulnerability that does not actually exist. Penetration testers must verify scanner findings to avoid reporting false positives.

snmpwalk is a standard SNMP tool to retrieve a subtree of MIB data, and nmap can be used with SNMP scripts to enumerate information.

After identifying a potentially vulnerable service, the tester should verify the vulnerability by attempting exploitation in a controlled manner to avoid false positives.

snmpwalk is a standard tool for retrieving a subtree of SNMP MIB data, often used for enumeration with the -v 2c version and -c community string.

A false positive occurs when a scanner incorrectly identifies a vulnerability that does not exist. This is common in automated vulnerability scanning and requires manual verification.

Nessus supports authenticated scanning using credentials (e.g., domain admin) to perform deep vulnerability assessment of Windows systems, including missing patches and insecure configurations.

Option A is correct because searching Pastebin for leaked credentials involves collecting information from publicly accessible sources without directly interacting with the target's systems. This is a classic passive reconnaissance technique, as it relies on third-party data and does not generate any network traffic to the target organization.

ffuf (Fuzz Faster U Fool) is a high-performance fuzzing tool used to discover API endpoints and hidden parameters by brute-forcing URLs, headers, and POST data. It supports wordlist-based fuzzing and can be used to enumerate RESTful API paths by replacing placeholders in the target URL, making it ideal for web application reconnaissance.

Using ARP scan (arp-scan) works on local networks and does not rely on ICMP, making it effective even when ICMP is blocked. It sends ARP requests and listens for replies.

Certificate transparency logs (e.g., crt.sh) are public logs of SSL/TLS certificates, often containing subdomain names. Querying them is passive and does not interact with the target.

The Wayback Machine archives historical snapshots of web pages, which can reveal old files, endpoints, or sensitive information that may have been removed but are still accessible on the live site.

Maltego is a data mining tool that visualizes relationships and can collect info from social media, DNS, and other sources. theHarvester gathers emails, subdomains, and names from public sources. LinkedIn is also used for organizational chart mapping, but the question asks for tools specifically.

Directory bruteforce tools like dirsearch, gobuster, and feroxbuster are designed to discover hidden directories and files by using wordlists. Nikto is a vulnerability scanner, not primarily for directory discovery. theHarvester is for email/subdomain harvesting.

Nessus performs version-based detection by analyzing server banners and HTTP response headers. If the web server's software version string is outdated or misconfigured, the scanner may flag vulnerabilities that do not actually exist in the patched or custom-compiled version. This is a classic false positive scenario where the scanner relies on version matching rather than actual exploit verification.

An AXFR (zone transfer) request is the correct choice because it retrieves the entire DNS zone file from a name server, which includes all record types (A, AAAA, MX, NS, TXT, etc.) for a domain. This provides a comprehensive list of publicly available DNS records, making it ideal for information gathering during a penetration test. In contrast, specific queries like NS or MX only return a single record type, limiting the scope of enumeration.

The filetype:pdf dork restricts results to PDF files. Other dorks target different file types or content.

Gobuster is a tool that performs directory/file brute-forcing using wordlists, making it ideal for discovering hidden directories and files. It can also be used to enumerate DNS subdomains and virtual hosts, directly supporting the task of finding hidden resources on a web server.

Manually verifying findings is the best practice to confirm if they are real vulnerabilities or false positives. Relying on scanner output alone is insufficient.

Feroxbuster is a fast, recursive content discovery tool that supports wordlist-based brute-forcing of directories, files, and API endpoints, with automatic recursion.

Shodan is a search engine for internet-connected devices, providing information about services and banners. It does not perform active scans itself; it indexes data from active scanning.

The SYN scan (-sS) sends a SYN packet and if a SYN/ACK is received, the port is considered open; it does not complete the handshake, making it stealthier than a full connect scan.

snmpwalk is a classic tool to walk through the SNMP MIB tree. onesixtyone is a tool for brute-forcing SNMP community strings. nmap can also be used with scripts, but snmp-check is a specific tool. snmpwalk and onesixtyone are direct SNMP enumeration tools.

Filtered ports in Nmap indicate that a firewall, packet filter, or other network obstacle is blocking the probe packets, preventing Nmap from determining whether the port is open or closed.

In a switched Ethernet environment, ARP (Address Resolution Protocol) operates at Layer 2 and does not require IP packets to discover hosts. The `arp-scan` tool sends ARP requests to the local broadcast MAC address, and live hosts respond with their MAC addresses, making it the most effective method for identifying live hosts without sending IP packets.

WPScan is a dedicated WordPress security scanner that enumerates installed plugins, themes, and known vulnerabilities by querying the WordPress API and fingerprinting version-specific files. It is purpose-built for WordPress assessments, making it the best choice for this task.

Certificate transparency logs, such as those queried via crt.sh, record SSL/TLS certificates issued for a domain. These certificates often include the origin server's IP address in the Subject Alternative Name (SAN) or other extensions, or they may reveal additional subdomains that point directly to the backend server, bypassing the CDN. This technique is effective because CDNs typically terminate SSL at the edge, but the certificate may still contain the true backend IP in historical or misconfigured entries.

The -A flag enables aggressive scanning which includes OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute (--traceroute).

The -x flag in Gobuster allows specifying extensions to append to each word during directory/file bruteforcing, enabling discovery of files with those extensions.

Nikto is a web server scanner that tests for misconfigurations, outdated software, and common vulnerabilities. Nessus is a general vulnerability scanner, WPScan is for WordPress, and OpenVAS is also a general vulnerability scanner.

Certificate Transparency logs (e.g., crt.sh) allow searching by domain or certificate fingerprint to find all certificates issued for that domain, often revealing subdomains.

snmpwalk is the correct tool because it uses SNMP GETNEXT requests to systematically traverse the entire Management Information Base (MIB) tree, retrieving all OID values from a device. Given the tester already has a valid community string ('public'), snmpwalk can extract detailed system information, running processes, and network interfaces without needing to guess or brute-force credentials.

Option D is correct because the `-sn` flag in Nmap performs a ping sweep (host discovery) without scanning any ports. It sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default to determine which hosts are alive on the 192.168.1.0/24 network, making it the ideal choice for identifying live hosts without port scanning.

Amass is a tool that performs subdomain enumeration using passive sources and active brute-forcing. Gobuster and dirsearch are for directory/file enumeration. Nmap is for port scanning.

WPScan is a dedicated WordPress vulnerability scanner that can enumerate plugins, themes, users, and known vulnerabilities. It can be configured to use passive methods or throttle requests to avoid detection.

The 'org' filter in Shodan allows searching by organization name, which is the most direct way to find devices associated with a company.

theHarvester collects data from public sources, so its results are limited to what is publicly available. It may miss internal email addresses and can include outdated information. It does not require authentication, and it is not limited to Google only.

Arjun is a tool for discovering HTTP parameters by brute-forcing common parameter names and analyzing responses for changes, making it suitable for parameter discovery.

The Wayback Machine (archive.org) is the correct choice because it archives historical snapshots of websites, allowing a penetration tester to review past versions of a target site to identify previously exposed vulnerabilities, hidden endpoints, or outdated configurations. This aligns with passive reconnaissance, as the tester does not interact directly with the live target.

Option A is correct because JavaScript files in client-side web applications often contain hardcoded API endpoints, API keys, and other secrets that developers inadvertently leave in the source code. By downloading and analyzing these files (e.g., via browser developer tools or wget), you can discover hidden endpoints and sensitive tokens that are not exposed in the HTML or network traffic alone.

Unauthenticated scans often miss vulnerabilities that require authentication, may produce false positives due to banner-based detection, and may not detect certain services that rely on authenticated checks. Nmap results are typically accurate for open ports. Missing open ports due to firewall is possible but less likely with Nmap SYN scan.

WPScan is specifically designed to enumerate and identify vulnerabilities in WordPress installations, including outdated plugins, themes, and core files. It uses a comprehensive database of WordPress CVEs and security issues, making it the most targeted tool for this task.

SNMP community strings are like passwords. 'public' is the default read-only community string, 'private' is the default read-write community string. 'internal' and 'manager' are less common defaults. The tester should try 'private' for potential read-write access.

The tester first performed a SYN scan with -sS to identify open ports, then used -sV for service version detection. -sC runs default scripts, -O is for OS detection, and -A enables aggressive scanning (includes OS detection, version detection, script scanning, and traceroute).

JavaScript analysis involves inspecting JavaScript files for hardcoded API endpoints, secrets, and other useful information, making it effective for discovering hidden API endpoints.

crt.sh is a certificate transparency log search tool that can be used to find subdomains by querying SSL/TLS certificates issued for a domain.

Gobuster and Feroxbuster are both tools specifically designed for directory and file brute-forcing on web servers.

Option C is correct because the `-sn` flag (ping scan) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default to determine if hosts are online without performing port scans. This minimizes network noise and quickly identifies live hosts on the subnet, which is the first step in active reconnaissance before deeper scanning.

Authenticated scanning provides deeper insight by checking for missing patches, misconfigurations, and vulnerabilities that require valid credentials to detect, such as local privilege escalation issues.

Gobuster is a tool used for directory/file brute-forcing using wordlists. Dirb is similar but older; gobuster is more modern and flexible.

Both -sn (ping sweep) and -sP (older alias for ping sweep) perform host discovery without port scanning. -sS and -sV are for port scanning and version detection respectively, not host discovery.

DNS zone transfer (AXFR) is a mechanism that allows a secondary DNS server to replicate the entire zone file from a primary server. If misconfigured, anyone can request it.

The -O option enables OS detection in Nmap.

Zone transfers use the AXFR (Authoritative Transfer) record type to replicate DNS data between servers.

Gobuster is a popular tool for directory and file brute-forcing using wordlists, making it ideal for discovering hidden resources on web servers.

Option C is correct because a false positive due to outdated plugin data must be manually verified before any action is taken. The tester should use a tool like `curl` or a browser to send the exact request that Nessus simulated (e.g., an HTTP GET to a specific endpoint) and inspect the response headers or body to confirm whether the vulnerability actually exists. Only after manual validation can the tester decide to include, exclude, or note the finding in the report.

Wappalyzer is a browser extension or online tool that identifies web technologies (CMS, frameworks, analytics) by analyzing page content and headers without sending probes.

Shodan is a search engine that indexes banners from internet-connected devices, including IoT, webcams, routers, and industrial control systems.