Which of the following is a common technique used to gather information from social media platforms?

Searching for the target's username across multiple platforms

Exploiting a vulnerability in the social media platform's API

Performing a port scan on social media servers

Sending phishing emails to the target's contacts

You are profiling a target individual for a social engineering test. You have their full name and the city where they live. You want to find their home address, phone number, and any associated relatives. Which public record source is most likely to provide this information?

Search property tax records and voter registration databases for the city

Use a search engine to look for the person's name and city

Search for the person on LinkedIn

Check the person's social media profiles for location tags

You are mapping a target's infrastructure and have discovered that the target uses a third-party DNS provider. You want to identify all subdomains and their IP addresses, but you also want to avoid detection by the target's security team. Which approach is most appropriate?

Use a subdomain brute-force tool like gobuster against the target's DNS servers

Use a search engine to find subdomains

Use whois to query the domain's DNS records

Use passive DNS databases and certificate transparency logs to enumerate subdomains

EC-CouncilCertified Penetration Testing Professional

Domain 2Objective 1

Open-Source Intelligence (OSINT) CPENT Practice Questions (Page 5)

Part of the Information Gathering and Social Engineering domain, which makes up ~9% of our current practice bank.

39questions here

8free pages

10concepts

Questions 21–25

21foundation · easy
Which of the following is a common technique used to gather information from social media platforms?
Select an answer first
22application · medium
You are conducting an external assessment and want to find any publicly accessible login pages or administrative interfaces on the target's web servers. You decide to use Google dorks. Which query is most effective for finding such pages?
Select an answer first
23foundation · easy
Which of the following is an example of a public database that can be used as an OSINT source?
Select an answer first
24application · medium
You are profiling a target individual for a social engineering test. You have their full name and the city where they live. You want to find their home address, phone number, and any associated relatives. Which public record source is most likely to provide this information?
Select an answer first
25expert · hard
You are mapping a target's infrastructure and have discovered that the target uses a third-party DNS provider. You want to identify all subdomains and their IP addresses, but you also want to avoid detection by the target's security team. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CPENT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CPENT” is a trademark of its owner, used for identification only.

Open-Source Intelligence (OSINT) CPENT Practice Questions (Page 5)

Questions 21–25

Which of the following is a common technique used to gather information from social media platforms?

You are conducting an external assessment and want to find any publicly accessible login pages or administrative interfaces on the target's web servers. You decide to use Google dorks. Which query is most effective for finding such pages?

Which of the following is an example of a public database that can be used as an OSINT source?

You are profiling a target individual for a social engineering test. You have their full name and the city where they live. You want to find their home address, phone number, and any associated relatives. Which public record source is most likely to provide this information?

You are mapping a target's infrastructure and have discovered that the target uses a third-party DNS provider. You want to identify all subdomains and their IP addresses, but you also want to avoid detection by the target's security team. Which approach is most appropriate?

Keep studying — Information Gathering and Social Engineering