PenTest+ Information Gathering & Vulnerability Identification 3 — Questions and Answers
Question 1: A penetration tester uses Recon-ng to automate OSINT collection. Which of the following best describes Recon-ng's primary function?
- A network packet analyzer for capturing live traffic
- A modular web reconnaissance framework for gathering open-source intelligence (Correct answer)
- An exploitation framework similar to Metasploit
- A password cracking utility for offline hash attacks
Correct answer: A modular web reconnaissance framework for gathering open-source intelligence
Recon-ng is a full-featured web reconnaissance framework with a modular design for automating OSINT gathering from multiple sources.
Question 2: During a pentest, a tester discovers a web server running an outdated version of Apache with a known CVE. What CVSS metric primarily describes whether the vulnerability can be exploited over the network without physical access?
- Attack Complexity
- Attack Vector (Correct answer)
- Privileges Required
- User Interaction
Correct answer: Attack Vector
The Attack Vector metric in CVSS describes the context in which exploitation is possible, including Network, Adjacent, Local, and Physical.
Question 3: Which tool is MOST commonly used to perform zone transfer attempts against a DNS server?
- dig (Correct answer)
- netstat
- traceroute
- nslookup with debug mode
Correct answer: dig
The `dig` command with the AXFR query type (e.g., `dig axfr @nameserver domain`) is the standard tool for attempting DNS zone transfers.
Question 4: A tester finds a web application that accepts user input in a URL parameter and reflects it back in the response. What vulnerability should be investigated FIRST?
- Command injection
- Cross-site scripting (XSS) (Correct answer)
- XML external entity (XXE) injection
- Server-side request forgery (SSRF)
Correct answer: Cross-site scripting (XSS)
When user input is reflected in the browser response without sanitization, cross-site scripting (XSS) is the primary vulnerability to investigate.
Question 5: When scoping a penetration test, which document formally defines the boundaries of testing and provides legal authorization?
- Non-disclosure agreement (NDA)
- Statement of work (SOW)
- Rules of engagement (ROE) (Correct answer)
- Master service agreement (MSA)
Correct answer: Rules of engagement (ROE)
The Rules of Engagement (ROE) document formally defines what systems can be tested, testing timeframes, and authorized techniques, providing the legal authorization for the pentest.
Question 6: A tester performs a credentialed vulnerability scan versus an uncredentialed scan. What is the PRIMARY advantage of a credentialed scan?
- It requires no access to the target network
- It identifies vulnerabilities that are only visible from an authenticated perspective, such as patch levels (Correct answer)
- It is faster because it skips authentication checks
- It bypasses firewall rules more effectively
Correct answer: It identifies vulnerabilities that are only visible from an authenticated perspective, such as patch levels
Credentialed scans authenticate to target systems and can inspect installed software versions, registry settings, and local configurations not visible externally.
Question 7: Which Nmap scan type sends SYN packets but never completes the TCP handshake, making it less likely to be logged by the target application?
- TCP connect scan (-sT)
- SYN stealth scan (-sS) (Correct answer)
- FIN scan (-sF)
- XMAS scan (-sX)
Correct answer: SYN stealth scan (-sS)
The SYN stealth scan (-sS) sends SYN packets and analyzes responses without completing the three-way handshake, so connections are never fully established and may avoid application-layer logging.
PenTest+ Information Gathering & Vulnerability Identification 3
A penetration tester uses Recon-ng to automate OSINT collection.
Which of the following best describes Recon-ng's primary function?