eJPT Information Gathering and Reconnaissance 2 — Questions and Answers
Question 1: Which DNS record type maps a domain name to an IPv6 address?
- A record
- AAAA record (Correct answer)
- MX record
- PTR record
Correct answer: AAAA record
AAAA records map a domain name to a 128-bit IPv6 address, while A records map to IPv4.
Question 2: A penetration tester wants to find all subdomains of a target without directly querying the target's DNS servers. Which technique is best?
- Zone transfer
- Certificate transparency log search (Correct answer)
- Ping sweep
- Banner grabbing
Correct answer: Certificate transparency log search
Certificate transparency logs (e.g., crt.sh) publicly record SSL/TLS certificates and reveal subdomains passively without alerting the target.
Question 3: What does the Nmap flag `-sV` accomplish during a scan?
- Enables stealth SYN scanning
- Performs version detection on open ports (Correct answer)
- Runs all default scripts
- Scans all 65535 ports
Correct answer: Performs version detection on open ports
`-sV` probes open ports to determine service/version information running on those ports.
Question 4: Which WHOIS field would reveal when a domain registration is set to expire?
- Creation Date
- Updated Date
- Registry Expiry Date (Correct answer)
- Registrar IANA ID
Correct answer: Registry Expiry Date
The Registry Expiry Date field in WHOIS records shows when the domain registration will expire.
Question 5: During passive reconnaissance, a tester finds an organization's LinkedIn page listing employee job titles and technologies used. This is an example of:
- Active scanning
- Social engineering
- OSINT gathering (Correct answer)
- Vulnerability exploitation
Correct answer: OSINT gathering
Gathering publicly available information from social media platforms like LinkedIn is a classic OSINT (Open Source Intelligence) technique.
Question 6: What is the primary purpose of a PTR (pointer) DNS record?
- Map domain to IPv4
- Map domain to mail server
- Map IP address to domain name (reverse DNS) (Correct answer)
- Define authoritative name servers
Correct answer: Map IP address to domain name (reverse DNS)
PTR records perform reverse DNS lookups, mapping an IP address back to a hostname.
Question 7: Which tool is commonly used for automated subdomain enumeration by brute-forcing with a wordlist?
- Wireshark
- Gobuster (Correct answer)
- Metasploit
- Burp Suite
Correct answer: Gobuster
Gobuster can brute-force subdomains using the `dns` mode with a wordlist to enumerate valid subdomains.
eJPT Information Gathering and Reconnaissance 2
Which DNS record type maps a domain name to an IPv6 address?