eJPT Information Gathering and Reconnaissance 5

Question 1

What is the function of the `host` command in Linux during DNS reconnaissance?

Accepted Answer

Perform DNS lookups to resolve domain names to IP addresses

Answer

The `host` command performs DNS lookups, resolving domain names to IPs and querying various DNS record types.

Question 2

During reconnaissance, a tester discovers the target uses Cloudflare. What challenge does this present?

Accepted Answer

Cloudflare may mask the real origin IP, making it harder to identify the actual server

Answer

Cloudflare acts as a reverse proxy, hiding the origin server's real IP address behind Cloudflare's IPs, complicating direct targeting.

Question 3

Which Nmap output format option saves results in all major formats simultaneously?

Accepted Answer

-oA

Answer

`-oA <basename>` saves scan results in normal, XML, and grepable formats simultaneously with the specified base filename.

Question 4

What type of information can be extracted from website metadata (e.g., PDF, DOCX files) during OSINT?

Accepted Answer

Author names, software versions, and GPS coordinates

Answer

Document metadata can reveal author names, creation software/versions, company names, and sometimes GPS coordinates embedded in images.

Question 5

A tester runs `nmap -sU -p 53,161 10.10.10.1`. Which protocols are being probed?

Accepted Answer

UDP DNS and SNMP

Answer

UDP port 53 is DNS and UDP port 161 is SNMP; the `-sU` flag specifies UDP scanning.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test