eJPT Information Gathering and Reconnaissance 2

Question 1

Which DNS record type maps a domain name to an IPv6 address?

Accepted Answer

AAAA record

Answer

AAAA records map a domain name to a 128-bit IPv6 address, while A records map to IPv4.

Question 2

A penetration tester wants to find all subdomains of a target without directly querying the target's DNS servers. Which technique is best?

Accepted Answer

Certificate transparency log search

Answer

Certificate transparency logs (e.g., crt.sh) publicly record SSL/TLS certificates and reveal subdomains passively without alerting the target.

Question 3

What does the Nmap flag `-sV` accomplish during a scan?

Accepted Answer

Performs version detection on open ports

Answer

`-sV` probes open ports to determine service/version information running on those ports.

Question 4

Which WHOIS field would reveal when a domain registration is set to expire?

Accepted Answer

Registry Expiry Date

Answer

The Registry Expiry Date field in WHOIS records shows when the domain registration will expire.

Question 5

During passive reconnaissance, a tester finds an organization's LinkedIn page listing employee job titles and technologies used. This is an example of:

Accepted Answer

OSINT gathering

Answer

Gathering publicly available information from social media platforms like LinkedIn is a classic OSINT (Open Source Intelligence) technique.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

eJPT Information Gathering and Reconnaissance 2