You are conducting social engineering reconnaissance for a client. You need to identify key employees who might be targeted for phishing attacks, including their roles, email addresses, and potential personal interests. Which source is most likely to provide this information while remaining within passive reconnaissance?

The company's internal employee directory, if accessible.

LinkedIn and other professional social networks.

The company's DNS records, which may reveal employee names in hostnames.

The company's annual report, which lists executives.

You are planning the reconnaissance phase for a penetration test. The client has a strict security monitoring team that actively alerts on any unusual traffic. You need to gather as much information as possible while minimizing the risk of detection. Which combination of techniques is most appropriate?

Use active techniques like port scanning and service enumeration, but with slow timing to avoid detection.

Use only passive techniques such as OSINT and search engine queries.

Skip reconnaissance and go directly to exploitation to save time.

Start with passive techniques, then use active techniques only when necessary, with careful timing and documentation.

What is the purpose of operating system fingerprinting?

To extract service banners from open ports

To map the network path to the target

To discover open ports on a target host

To determine the operating system running on a target host

GIAC Penetration Tester (GPEN)

Domain 1Objective 2

Reconnaissance GPEN Practice Questions (Page 11)

Part of the Penetration Testing Foundations domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

12concepts

Questions 51–55

51foundation · easy
Which Nmap option is used for operating system fingerprinting?
Select an answer first
52application · medium
You are conducting social engineering reconnaissance for a client. You need to identify key employees who might be targeted for phishing attacks, including their roles, email addresses, and potential personal interests. Which source is most likely to provide this information while remaining within passive reconnaissance?
Select an answer first
53application · medium
You are planning the reconnaissance phase for a penetration test. The client has a strict security monitoring team that actively alerts on any unusual traffic. You need to gather as much information as possible while minimizing the risk of detection. Which combination of techniques is most appropriate?
Select an answer first
54foundation · easy
What is the purpose of operating system fingerprinting?
Select an answer first
55foundation · easy
Which tool is commonly used for network scanning to identify live hosts and open ports?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Reconnaissance GPEN Practice Questions (Page 11)

Questions 51–55

Which Nmap option is used for operating system fingerprinting?

What is the purpose of operating system fingerprinting?

Which tool is commonly used for network scanning to identify live hosts and open ports?

Keep studying — Penetration Testing Foundations