A client is concerned about the amount of information an attacker could gather about their organization without any direct interaction. They ask you to explain what OSINT is and how it fits into a penetration test. Which statement best describes OSINT in this context?

OSINT is the collection and analysis of information from publicly available sources to support intelligence gathering.

OSINT is the analysis of malware to determine its origin and purpose.

OSINT is the process of scanning a network for open ports and services.

OSINT is the use of social engineering to trick employees into revealing information.

You are searching for sensitive documents that may have been accidentally exposed on the target's website. You want to find PDF files that contain the word 'confidential' and are hosted on the target's domain. Which search query is most effective?

site:target.com "confidential" pdf

intitle:confidential filetype:pdf

filetype:pdf confidential target.com

site:target.com filetype:pdf "confidential"

You are profiling a high-value target for a social engineering test. The target is very private on social media, but you have found their employer and their professional email address. You need to gather personal information that could be used to build trust. Which approach is most likely to yield useful personal information?

Search for the target's name in public court records

Search for the target's name on LinkedIn and Twitter

Search for the email address on data breach databases and public paste sites

Use a people search engine to find their home address and phone number

During an external assessment, you are mapping the target's internet-facing infrastructure. You have the domain name but need to discover additional subdomains and associated IP addresses. Which approach is most effective?

Query the domain's mail exchange (MX) record

Use WHOIS lookup to find the domain registrar

Search the target's website for links to other domains

Perform DNS enumeration using tools like dnsrecon or fierce

EC-CouncilCertified Penetration Testing Professional

Domain 2Objective 1

Open-Source Intelligence (OSINT) CPENT Practice Questions (Page 4)

Part of the Information Gathering and Social Engineering domain, which makes up ~9% of our current practice bank.

39questions here

8free pages

10concepts

Questions 16–20

16application · easy
A client is concerned about the amount of information an attacker could gather about their organization without any direct interaction. They ask you to explain what OSINT is and how it fits into a penetration test. Which statement best describes OSINT in this context?
Select an answer first
17application · medium
You are searching for sensitive documents that may have been accidentally exposed on the target's website. You want to find PDF files that contain the word 'confidential' and are hosted on the target's domain. Which search query is most effective?
Select an answer first
18expert · hard
You are profiling a high-value target for a social engineering test. The target is very private on social media, but you have found their employer and their professional email address. You need to gather personal information that could be used to build trust. Which approach is most likely to yield useful personal information?
Select an answer first
19application · medium
During an external assessment, you are mapping the target's internet-facing infrastructure. You have the domain name but need to discover additional subdomains and associated IP addresses. Which approach is most effective?
Select an answer first
20foundation · easy
Which DNS record type is used to map a domain name to an IPv6 address?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CPENT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CPENT” is a trademark of its owner, used for identification only.

Open-Source Intelligence (OSINT) CPENT Practice Questions (Page 4)

Questions 16–20

A client is concerned about the amount of information an attacker could gather about their organization without any direct interaction. They ask you to explain what OSINT is and how it fits into a penetration test. Which statement best describes OSINT in this context?

You are searching for sensitive documents that may have been accidentally exposed on the target's website. You want to find PDF files that contain the word 'confidential' and are hosted on the target's domain. Which search query is most effective?

During an external assessment, you are mapping the target's internet-facing infrastructure. You have the domain name but need to discover additional subdomains and associated IP addresses. Which approach is most effective?

Which DNS record type is used to map a domain name to an IPv6 address?

Keep studying — Information Gathering and Social Engineering