PenTest+ Information Gathering & Vulnerability Identification 5 — Questions and Answers
Question 1: A penetration tester discovers that a web application uses predictable session token values (e.g., sequential integers). Which vulnerability category does this represent?
- Broken authentication due to weak session management (Correct answer)
- Insecure direct object reference (IDOR)
- Cross-site request forgery (CSRF)
- Clickjacking vulnerability
Correct answer: Broken authentication due to weak session management
Predictable session tokens fall under broken authentication — weak session management allows attackers to guess or forge valid session identifiers.
Question 2: When performing passive DNS reconnaissance, which resource provides historical DNS records including past IP addresses associated with a domain?
- WHOIS database
- Passive DNS databases (e.g., RiskIQ, SecurityTrails) (Correct answer)
- Certificate transparency logs
- ARIN IP allocation records
Correct answer: Passive DNS databases (e.g., RiskIQ, SecurityTrails)
Passive DNS databases aggregate historical DNS resolution data, allowing testers to find past IP addresses and infrastructure changes for a domain.
Question 3: During a network scan, a tester finds ports 135, 139, and 445 open on multiple hosts. What does this combination MOST likely indicate?
- Linux servers running Samba
- Windows systems with SMB and RPC services (Correct answer)
- Network printers with management interfaces
- Database servers with remote access enabled
Correct answer: Windows systems with SMB and RPC services
Ports 135 (RPC), 139 (NetBIOS), and 445 (SMB) are characteristic Windows networking ports used for file sharing and remote procedure calls.
Question 4: A tester reviews SSL/TLS certificate information for a target and discovers Subject Alternative Names (SANs) listing additional domains. Why is this significant for reconnaissance?
- SANs reveal the certificate authority's private key
- SANs can expose additional subdomains and related domains in scope (Correct answer)
- SANs indicate the certificate is self-signed and therefore vulnerable
- SANs contain the server's internal IP address
Correct answer: SANs can expose additional subdomains and related domains in scope
SAN entries in SSL certificates often list multiple hostnames and subdomains, providing valuable reconnaissance data about the organization's infrastructure.
Question 5: Which phase of the penetration testing process involves documenting discovered vulnerabilities, their potential impact, and remediation recommendations?
- Planning and scoping
- Exploitation
- Reporting (Correct answer)
- Post-exploitation
Correct answer: Reporting
The reporting phase documents all findings including vulnerability details, evidence, business impact, and prioritized remediation guidance for the client.
Question 6: A tester uses Masscan to perform rapid port scanning across a large IP range. What is the PRIMARY risk of using Masscan at high packet rates during a pentest?
- The scan results will be inaccurate due to TCP handshake limitations
- High packet rates may trigger IDS/IPS alerts or disrupt network devices (Correct answer)
- Masscan cannot scan UDP ports, limiting vulnerability discovery
- The tool may expose the tester's identity through unique packet signatures
Correct answer: High packet rates may trigger IDS/IPS alerts or disrupt network devices
Masscan's extremely high packet rates can overwhelm network devices, trigger intrusion detection systems, and potentially disrupt services on the target network.
Question 7: What does the term 'attack surface' refer to in the context of vulnerability identification during a penetration test?
- The total number of CVEs identified during scanning
- All the different points where an attacker could attempt to enter or extract data (Correct answer)
- The physical area of the target facility being tested
- The list of exploits available in Metasploit for the target OS
Correct answer: All the different points where an attacker could attempt to enter or extract data
The attack surface encompasses all potential entry points, interfaces, protocols, and data paths through which an attacker could attempt to compromise the target.
PenTest+ Information Gathering & Vulnerability Identification 5
A penetration tester discovers that a web application uses predictable session token values (e.g., sequential integers).
Which vulnerability category does this represent?