CREST OSINT & Reconnaissance Techniques

Question 1

What does OSINT stand for in the context of penetration testing and intelligence gathering?

Accepted Answer

Open Source Intelligence

Answer

Open System Information Network

Answer

Operational Security Intelligence

Answer

Online Security Information Technology

Question 2

Which search engine is primarily used to discover internet-connected devices and their exposed service banners?

Accepted Answer

Shodan

Answer

Google

Answer

Bing

Answer

DuckDuckGo

Question 3

Which Google dork operator is used to restrict search results to a specific domain during OSINT?

Accepted Answer

site:

Answer

inurl:

Answer

filetype:

Answer

intitle:

Question 4

What is the primary purpose of WHOIS lookups during the reconnaissance phase of a CREST penetration test?

Accepted Answer

To gather domain registration and ownership information

Answer

To scan for open ports on a target

Answer

To enumerate web application vulnerabilities

Answer

To find SQL injection entry points

Question 5

In penetration testing methodology, what term describes gathering information about a target exclusively from public sources before active testing begins?

Accepted Answer

Footprinting

Answer

Exploitation

Answer

Lateral movement

Answer

Pivoting

Question 6

What valuable reconnaissance data can be extracted from Certificate Transparency (CT) logs?

Accepted Answer

Subdomains and SANs listed in issued SSL/TLS certificates

Answer

Open port listings and running services

Answer

Employee usernames and email addresses

Answer

Source code of web applications

Question 7

Which DNS record type is most useful during OSINT to identify an organization's mail server infrastructure?

Accepted Answer

MX record

Answer

A record

Answer

CNAME record

Answer

PTR record