Active and Passive Reconnaissance PT0-003 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A penetration tester is conducting passive reconnaissance on a target company. The tester wants to discover subdomains and associated IP addresses without directly querying the target's DNS servers. Which technique would be most effective?

   • AUse certificate transparency logs to find subdomains
   • BUse Nmap to scan the target's IP range for open ports
   • CPerform a DNS zone transfer from the target's authoritative server
   • DRun a brute-force subdomain enumeration tool like gobuster
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A penetration tester is performing OSINT on a target organization. The tester finds that the organization's employees frequently post about their work on social media, including details about internal tools and project names. The tester also discovers that the organization's website has a careers page listing job openings for specific technologies. How can the tester combine this information to build a more effective attack strategy?

   • AUse the technology names from job postings and social media to create a list of potential vulnerabilities to test
   • BUse the social media posts to craft phishing emails, but ignore the technology stack
   • CUse the employee names to perform a port scan on their personal devices
   • DUse the project names to perform a DNS brute-force to find internal servers
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A penetration tester is scanning a target network and discovers that port 80 is open on a host. The tester wants to identify the web application and its version, but the server does not return a standard banner. Which technique would be most effective?

   • ARun a DNS brute-force to find virtual hosts
   • BPerform a full TCP connect scan on all ports
   • CUse Wireshark to capture traffic to the web server
   • DSend HTTP requests with different methods (e.g., OPTIONS, HEAD) and analyze the response headers
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A penetration tester is performing OSINT on a target organization. The tester finds a PDF document on the organization's website that contains metadata with the username 'jdoe' and the software used to create the document. How can this information be used in the penetration test?

   • ATo bypass WAF rules
   • BTo identify potential usernames for credential attacks
   • CTo determine the target's network topology
   • DTo identify open ports on the target's servers
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A penetration tester is performing service enumeration on a target that has port 3306 open. The tester wants to determine the exact version of the database software running. Which tool would be most appropriate?

   • ANslookup to query DNS records
   • BNmap with the -sV flag
   • CtheHarvester to search for email addresses
   • DWireshark to capture traffic on the local network
   Reveal Solution Discussion Select an answer first