CREST OSINT & Reconnaissance Techniques 2

Question 1

What is the primary function of the theHarvester tool in OSINT reconnaissance?

Accepted Answer

Gathering emails, subdomains, and employee names from public search engines

Answer

Scanning target networks for open vulnerabilities

Answer

Cracking password hashes obtained from target systems

Answer

Exploiting web application injection vulnerabilities

Question 2

What is 'metadata harvesting' in the context of OSINT document analysis?

Accepted Answer

Extracting embedded information such as author names, software versions, and GPS coordinates from files

Answer

Collecting database schemas from target systems

Answer

Gathering network topology diagrams from public sources

Answer

Enumerating email server configuration details

Question 3

Which tool is specifically designed to extract and analyze metadata from publicly available documents to profile organizations?

Accepted Answer

FOCA (Fingerprinting Organizations with Collected Archives)

Answer

Nessus

Answer

OpenVAS

Answer

Hydra

Question 4

What does ASN stand for, and why is identifying it important during network reconnaissance?

Accepted Answer

Autonomous System Number — identifies IP ranges owned by an organization under a common routing policy

Answer

Application Security Notification — used to report vulnerabilities to vendors

Answer

Advanced Scanning Node — used to route probe packets

Answer

Attack Surface Navigator — used to map exploitable assets

Question 5

Which OSINT methodology involves analyzing an organization's job postings to infer details about their technology stack?

Accepted Answer

Job intelligence gathering

Answer

Certificate transparency analysis

Answer

Passive DNS enumeration

Answer

Social graph mapping

Question 6

What is the primary advantage of passive OSINT reconnaissance compared to active scanning techniques?

Accepted Answer

It does not generate traffic to the target, greatly reducing detection risk

Answer

It provides more granular technical vulnerability details

Answer

It is significantly faster to execute than active scans

Answer

It can bypass perimeter firewalls more effectively

Question 7

Which tool provides a graphical interface for mapping entity relationships—linking people, organizations, domains, and IP addresses from public sources?

Accepted Answer

Maltego

Answer

Wireshark

Answer

Burp Suite

Answer

Metasploit