PenTest+ Information Gathering & Vulnerability Identification 2 — Questions and Answers
Question 1: A penetration tester uses theHarvester to collect email addresses and subdomains for a target organization. What category of reconnaissance does this represent?
- Active reconnaissance
- Passive reconnaissance (Correct answer)
- Internal reconnaissance
- Physical reconnaissance
Correct answer: Passive reconnaissance
theHarvester gathers data from public sources (search engines, DNS records) without directly interacting with the target, making it passive reconnaissance.
Question 2: During OSINT gathering, a tester finds the target company's employees frequently post on LinkedIn with job titles referencing specific internal tools. How should this information be classified?
- Irrelevant data to be discarded
- Technical intelligence that may reveal internal technology stack (Correct answer)
- Personal data only useful for phishing
- Confidential data requiring legal review before use
Correct answer: Technical intelligence that may reveal internal technology stack
Job postings and LinkedIn profiles can reveal internal technologies, frameworks, and tools, providing valuable technical intelligence for attack planning.
Question 3: Which DNS record type would a penetration tester query to identify the mail servers associated with a target domain?
- A record
- CNAME record
- MX record (Correct answer)
- PTR record
Correct answer: MX record
MX (Mail Exchanger) records specify the mail servers responsible for accepting email for a domain.
Question 4: A tester performs a Shodan search and discovers an exposed industrial control system (ICS) device belonging to the target. What is the MOST appropriate next step?
- Immediately attempt to exploit the device to prove impact
- Document the finding and report it to the client before any further action (Correct answer)
- Ignore it since ICS is out of scope for most pentests
- Attempt to log in with default credentials to confirm vulnerability
Correct answer: Document the finding and report it to the client before any further action
Exposed ICS/SCADA systems carry significant risk; the tester should document the finding and consult the client before taking any action that could cause disruption.
Question 5: Which technique involves sending specially crafted packets to a target and analyzing the responses to determine the operating system version?
- Banner grabbing
- OS fingerprinting (Correct answer)
- Service enumeration
- Port sweeping
Correct answer: OS fingerprinting
OS fingerprinting analyzes TCP/IP stack responses and timing characteristics to identify the target operating system and version.
Question 6: A tester discovers that a web application returns different HTTP response codes (200 vs 302) depending on whether a username exists during login attempts. What vulnerability does this indicate?
- SQL injection
- Username enumeration (Correct answer)
- Directory traversal
- Session fixation
Correct answer: Username enumeration
Differential responses based on whether a username exists allows attackers to enumerate valid usernames, enabling targeted credential attacks.
Question 7: When using Nmap's -sV flag, what additional information does the tester receive compared to a standard port scan?
- The geographic location of the target server
- Service and version information for open ports (Correct answer)
- Vulnerability CVE identifiers for each service
- The operating system kernel version
Correct answer: Service and version information for open ports
The -sV flag enables version detection, causing Nmap to probe open ports and report the service name and version running on each.
PenTest+ Information Gathering & Vulnerability Identification 2
A penetration tester uses theHarvester to collect email addresses and subdomains for a target organization.
What category of reconnaissance does this represent?