eJPT - eLearnSecurity Junior Penetration Tester Information Gathering and Reconnaissance Questions and Answers

Question 1

A penetration tester is in the initial phase of an assessment and wants to gather information about a target company without directly interacting with its systems.
Which of the following approaches is most appropriate?

Accepted Answer

Querying public WHOIS records and analyzing DNS information.

Answer

Running a port scan with Nmap against the company's web server.

Answer

Using a vulnerability scanner to probe for weaknesses in their external network.

Answer

Attempting a zone transfer to enumerate all hosts in their domain.

Question 2

During a web application reconnaissance, a tester discovers a `robots.txt` file. What is the primary purpose of this file from a security perspective?

Accepted Answer

To suggest which directories search engines should not index, potentially revealing sensitive paths.

Answer

To list all the administrator usernames and passwords.

Answer

To provide a list of all vulnerabilities present on the web server.

Answer

To block malicious crawlers from accessing the website.

Question 3

A junior penetration tester is tasked with finding subdomains for a target domain. Which of the following tools is specifically designed for subdomain enumeration using various public sources and brute-force techniques?

Accepted Answer

Sublist3r

Answer

Nmap

Answer

Wireshark

Answer

Metasploit

Question 4

Which of the following Nmap commands would be used to perform a fast scan of the 100 most common ports on a target, discover service versions, and run default scripts, while treating the host as online and skipping the host discovery phase?

Accepted Answer

nmap -Pn -F -sV -sC 192.168.1.100

Answer

nmap -sS -A -T4 192.168.1.100

Answer

nmap -sn -p- 192.168.1.100

Answer

nmap -O --top-ports 20 192.168.1.100

Question 5

A penetration tester is performing OSINT on a target company and wants to gather employee names, email addresses, and subdomains from public sources like search engines. Which tool is best suited for this task?

Accepted Answer

theHarvester

Answer

Gobuster

Answer

Nikto

Answer

Hydra

Question 6

When comparing active and passive reconnaissance, which of the following is a primary characteristic of active reconnaissance?

Accepted Answer

It involves direct interaction with the target's systems, creating network traffic that can be logged.

Answer

It is undetectable by the target organization.

Answer

It relies solely on publicly available information like social media and news articles.

Answer

It has a lower chance of providing accurate, real-time data compared to passive methods.

A penetration tester is in the initial phase of an assessment and wants to gather information about a target company without directly interacting with its systems.Which of the following approaches is most appropriate?

A penetration tester is in the initial phase of an assessment and wants to gather information about a target company without directly interacting with its systems.
Which of the following approaches is most appropriate?