CREST OSINT & Reconnaissance Techniques

Question 1

What does OSINT stand for in the context of penetration testing and intelligence gathering?

Accepted Answer

Open Source Intelligence

Answer

OSINT stands for Open Source Intelligence, referring to intelligence gathered from publicly available sources without direct interaction with the target.

Question 2

Which search engine is primarily used to discover internet-connected devices and their exposed service banners?

Accepted Answer

Shodan

Answer

Shodan indexes internet-connected devices and their banners, making it invaluable for finding exposed services, open ports, and vulnerable systems.

Question 3

Which Google dork operator is used to restrict search results to a specific domain during OSINT?

Accepted Answer

site:

Answer

The 'site:' operator in Google advanced search restricts all results to a specified domain or subdomain.

Question 4

What is the primary purpose of WHOIS lookups during the reconnaissance phase of a CREST penetration test?

Accepted Answer

To gather domain registration and ownership information

Answer

WHOIS lookups reveal domain registration details including registrant contact information, registration dates, expiry, and name servers.

Question 5

In penetration testing methodology, what term describes gathering information about a target exclusively from public sources before active testing begins?

Accepted Answer

Footprinting

Answer

Footprinting is the process of systematically gathering publicly available information about a target to build an intelligence profile prior to active engagement.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST OSINT & Reconnaissance Techniques