PenTest+ Information Gathering & Vulnerability Identification 5

Question 1

A penetration tester discovers that a web application uses predictable session token values (e.g., sequential integers). Which vulnerability category does this represent?

Accepted Answer

Broken authentication due to weak session management

Answer

Predictable session tokens fall under broken authentication — weak session management allows attackers to guess or forge valid session identifiers.

Question 2

When performing passive DNS reconnaissance, which resource provides historical DNS records including past IP addresses associated with a domain?

Accepted Answer

Passive DNS databases (e.g., RiskIQ, SecurityTrails)

Answer

Passive DNS databases aggregate historical DNS resolution data, allowing testers to find past IP addresses and infrastructure changes for a domain.

Question 3

During a network scan, a tester finds ports 135, 139, and 445 open on multiple hosts. What does this combination MOST likely indicate?

Accepted Answer

Windows systems with SMB and RPC services

Answer

Ports 135 (RPC), 139 (NetBIOS), and 445 (SMB) are characteristic Windows networking ports used for file sharing and remote procedure calls.

Question 4

A tester reviews SSL/TLS certificate information for a target and discovers Subject Alternative Names (SANs) listing additional domains. Why is this significant for reconnaissance?

Accepted Answer

SANs can expose additional subdomains and related domains in scope

Answer

SAN entries in SSL certificates often list multiple hostnames and subdomains, providing valuable reconnaissance data about the organization's infrastructure.

Question 5

Which phase of the penetration testing process involves documenting discovered vulnerabilities, their potential impact, and remediation recommendations?

Accepted Answer

Reporting

Answer

The reporting phase documents all findings including vulnerability details, evidence, business impact, and prioritized remediation guidance for the client.

(PenTest+) CompTIA PenTest+ Certification Practice Test

(PenTest+) CompTIA PenTest+ Certification Practice Test

PenTest+ Information Gathering & Vulnerability Identification 5