During a penetration test, you are tasked with mapping the external attack surface of a client's domain. You have been given the domain 'example.com' and need to identify all publicly accessible subdomains and their associated IP addresses. You want to avoid direct interaction with the client's web servers during this phase. Which technique is most appropriate?

Run an Nmap SYN scan against the entire IP range owned by the domain to identify live hosts.

Use a web crawler to enumerate links and subdomains from the main website.

Perform DNS enumeration using tools like 'dig' to query common subdomains and brute-force DNS records.

Query the WHOIS database for the domain to get a list of all subdomains.

What is the purpose of a network scan in the reconnaissance phase?

To crack passwords of network services

To identify live hosts, open ports, and running services on a target network

To intercept and analyze network traffic

To exploit vulnerabilities in discovered services

You are leading a penetration test team. A junior tester asks why reconnaissance is important when they could just start scanning the target immediately. Which response best explains the role of reconnaissance in the penetration testing process?

Reconnaissance is mainly for writing the final report.

Reconnaissance helps identify the attack surface and potential entry points, reducing the chance of missing critical vulnerabilities.

Reconnaissance is optional and only needed for external tests.

Reconnaissance is only used to gather employee information for social engineering.

You are scanning a target host that is behind a stateful firewall. The firewall is configured to allow only HTTP (port 80) and HTTPS (port 443) inbound. You need to determine the operating system of the host. Which technique is most likely to succeed?

Perform a UDP scan on port 53 to elicit a response.

Use passive OS fingerprinting by capturing traffic from the host.

Send ICMP timestamp requests to the host.

Use Nmap OS detection (-O) with a SYN scan against port 80 and 443.

GIAC Penetration Tester (GPEN)

Domain 1Objective 2

Reconnaissance GPEN Practice Questions (Page 10)

Part of the Penetration Testing Foundations domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

12concepts

Questions 46–50

46application · medium
During a penetration test, you are tasked with mapping the external attack surface of a client's domain. You have been given the domain 'example.com' and need to identify all publicly accessible subdomains and their associated IP addresses. You want to avoid direct interaction with the client's web servers during this phase. Which technique is most appropriate?
Select an answer first
47foundation · easy
Which of the following is a common source for social engineering reconnaissance?
Select an answer first
48foundation · easy
What is the purpose of a network scan in the reconnaissance phase?
Select an answer first
49application · medium
You are leading a penetration test team. A junior tester asks why reconnaissance is important when they could just start scanning the target immediately. Which response best explains the role of reconnaissance in the penetration testing process?
Select an answer first
50expert · hard
You are scanning a target host that is behind a stateful firewall. The firewall is configured to allow only HTTP (port 80) and HTTPS (port 443) inbound. You need to determine the operating system of the host. Which technique is most likely to succeed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Reconnaissance GPEN Practice Questions (Page 10)

Questions 46–50

Which of the following is a common source for social engineering reconnaissance?

What is the purpose of a network scan in the reconnaissance phase?

You are leading a penetration test team. A junior tester asks why reconnaissance is important when they could just start scanning the target immediately. Which response best explains the role of reconnaissance in the penetration testing process?

You are scanning a target host that is behind a stateful firewall. The firewall is configured to allow only HTTP (port 80) and HTTPS (port 443) inbound. You need to determine the operating system of the host. Which technique is most likely to succeed?

Keep studying — Penetration Testing Foundations