Reconnaissance GPEN Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   You are conducting a penetration test and have gathered a significant amount of reconnaissance data, including DNS records, subdomains, employee information, and network paths. You need to ensure this information is organized and accessible for later phases of the test. Which practice is most appropriate?

   • ARecord all findings in a structured document or database, noting the source and date of each piece of information.
   • BEmail the findings to your personal email account for safekeeping.
   • CStore the data in a text file on the client's server for easy access.
   • DKeep all findings in your memory to avoid leaving traces on the client's systems.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   You are mapping a client's network as part of a penetration test. You need to identify the network path to a target server and determine if there are any firewalls or filters that might block certain types of traffic. Which technique is most appropriate?

   • APerform a DNS zone transfer to get a list of all network devices.
   • BUse traceroute with different protocols (ICMP, TCP, UDP) to map the path and identify filtering.
   • CUse Nmap's OS detection to identify the operating systems of all devices on the path.
   • DQuery the WHOIS database for the IP address of the target to see the network path.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What type of information can be harvested from metadata of public documents?

   • AUsernames, software versions, and internal paths
   • BNetwork traffic captures
   • CFirewall rules and ACLs
   • DEncrypted passwords and hashes
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What type of information is typically gathered during social engineering reconnaissance?

   • APersonal details of employees, such as job titles and contact information
   • BOperating system versions of target servers
   • CDNS records and hostnames
   • DOpen ports and services on the target network
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which statement best describes the role of reconnaissance in a penetration test?

   • AIt is the systematic gathering of information about a target to support later attack phases
   • BIt is an optional step that can be skipped if the client provides network diagrams
   • CIt is the final phase where the tester writes the report and presents findings
   • DIt is the phase where the tester actively exploits vulnerabilities to gain access
   Reveal Solution Discussion Select an answer first