PenTest+ Information Gathering & Vulnerability Identification 4

Question 1

A tester is enumerating a target network and discovers an SNMP service running with default community strings. What information can typically be extracted via SNMP v1/v2c?

Accepted Answer

Network topology, routing tables, and running processes

Answer

SNMP with default community strings like 'public' can expose network topology, interface information, routing tables, ARP tables, and running processes.

Question 2

During passive reconnaissance, a tester reviews the target's robots.txt file and finds entries for '/admin/', '/backup/', and '/config/'. What should the tester do with this information?

Accepted Answer

Use the discovered paths as targets for further active enumeration

Answer

robots.txt disallowed entries often reveal sensitive directories; these paths should be noted and investigated during active testing within scope.

Question 3

What is the purpose of running a vulnerability scan with 'safe checks' enabled in tools like Nessus or OpenVAS?

Accepted Answer

To avoid running plugins that could crash or disrupt target services

Answer

Safe checks prevent the scanner from running destructive or denial-of-service-inducing plugins that could crash or disrupt production systems.

Question 4

A penetration tester uses Google dorks to find exposed configuration files. Which search operator would help find files with '.env' extension on a specific target domain?

Accepted Answer

site:target.com filetype:env

Answer

Google dork syntax uses `site:` to restrict results to a domain and `filetype:` to filter by file extension, making `site:target.com filetype:env` the correct operator combination.

Question 5

When performing web application reconnaissance, what does 'spidering' or 'crawling' a target website accomplish?

Accepted Answer

It maps all reachable pages and resources by following links automatically

Answer

Spidering follows hyperlinks starting from a seed URL to systematically discover and map all accessible pages and resources on the web application.

(PenTest+) CompTIA PenTest+ Certification Practice Test

(PenTest+) CompTIA PenTest+ Certification Practice Test

PenTest+ Information Gathering & Vulnerability Identification 4