eJPT Information Gathering and Reconnaissance 3

Question 1

What information does the `traceroute` command provide during reconnaissance?

Accepted Answer

The network path and hops between source and destination

Answer

Traceroute reveals each network hop (router) between the source and destination, helping map network topology.

Question 2

An attacker queries `shodan.io` for a target company's IP range. This is an example of which reconnaissance method?

Accepted Answer

Passive reconnaissance

Answer

Querying Shodan retrieves data collected by third parties without directly touching the target, making it passive reconnaissance.

Question 3

Which Nmap scan type sends only SYN packets and never completes the TCP handshake, making it stealthier?

Accepted Answer

-sS (SYN Stealth)

Answer

The SYN scan (`-sS`) sends a SYN packet and, upon receiving SYN-ACK, sends RST without completing the 3-way handshake, leaving fewer logs.

Question 4

A tester uses `theHarvester` against a target domain. What type of information does this tool collect?

Accepted Answer

Email addresses, subdomains, and employee names from public sources

Answer

theHarvester gathers emails, subdomains, hosts, and employee names from search engines, LinkedIn, and other public sources.

Question 5

What does a 'wildcard DNS entry' (*.example.com) mean for subdomain enumeration?

Accepted Answer

Every subdomain query returns a valid response, making brute-force results unreliable

Answer

A wildcard entry makes all subdomain lookups resolve, so brute-force tools return false positives for every queried subdomain.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test