PenTest+ Information Gathering & Vulnerability Identification 4 — Questions and Answers
Question 1: A tester is enumerating a target network and discovers an SNMP service running with default community strings. What information can typically be extracted via SNMP v1/v2c?
- Only device uptime statistics
- Network topology, routing tables, and running processes (Correct answer)
- Encrypted user credentials only
- Hardware serial numbers exclusively
Correct answer: Network topology, routing tables, and running processes
SNMP with default community strings like 'public' can expose network topology, interface information, routing tables, ARP tables, and running processes.
Question 2: During passive reconnaissance, a tester reviews the target's robots.txt file and finds entries for '/admin/', '/backup/', and '/config/'. What should the tester do with this information?
- Ignore it since robots.txt is only relevant to web crawlers
- Use the discovered paths as targets for further active enumeration (Correct answer)
- Report it as a critical finding without further investigation
- Immediately attempt to access the /backup/ directory
Correct answer: Use the discovered paths as targets for further active enumeration
robots.txt disallowed entries often reveal sensitive directories; these paths should be noted and investigated during active testing within scope.
Question 3: What is the purpose of running a vulnerability scan with 'safe checks' enabled in tools like Nessus or OpenVAS?
- To ensure the scan only targets systems explicitly listed in scope
- To avoid running plugins that could crash or disrupt target services (Correct answer)
- To encrypt all scan traffic between the scanner and target
- To limit results to critical and high severity findings only
Correct answer: To avoid running plugins that could crash or disrupt target services
Safe checks prevent the scanner from running destructive or denial-of-service-inducing plugins that could crash or disrupt production systems.
Question 4: A penetration tester uses Google dorks to find exposed configuration files. Which search operator would help find files with '.env' extension on a specific target domain?
- site:target.com filetype:env (Correct answer)
- inurl:target.com ext:env
- domain:target.com file:.env
- host:target.com type:env
Correct answer: site:target.com filetype:env
Google dork syntax uses `site:` to restrict results to a domain and `filetype:` to filter by file extension, making `site:target.com filetype:env` the correct operator combination.
Question 5: When performing web application reconnaissance, what does 'spidering' or 'crawling' a target website accomplish?
- It brute-forces hidden directories not linked from the main site
- It maps all reachable pages and resources by following links automatically (Correct answer)
- It captures all HTTP traffic between clients and the server
- It identifies SQL injection points in web forms
Correct answer: It maps all reachable pages and resources by following links automatically
Spidering follows hyperlinks starting from a seed URL to systematically discover and map all accessible pages and resources on the web application.
Question 6: A tester identifies a service responding on port 8443. What is the MOST likely service running on this port?
- Standard HTTP web server
- HTTPS alternate port (often used for admin panels or alternative SSL services) (Correct answer)
- FTP over TLS
- LDAP over SSL
Correct answer: HTTPS alternate port (often used for admin panels or alternative SSL services)
Port 8443 is a common alternate port for HTTPS, frequently used for administrative interfaces, development servers, or secondary SSL/TLS services.
Question 7: Which concept describes the process of correlating data from multiple OSINT sources to build a comprehensive profile of a target?
- Data normalization
- Intelligence fusion (Correct answer)
- Threat modeling
- Attack surface mapping
Correct answer: Intelligence fusion
Intelligence fusion involves combining and correlating data from multiple disparate OSINT sources to create a unified, comprehensive picture of the target.
PenTest+ Information Gathering & Vulnerability Identification 4
A tester is enumerating a target network and discovers an SNMP service running with default community strings.
What information can typically be extracted via SNMP v1/v2c?