Reconnaissance GPEN Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   You are conducting an authorized penetration test against a target network. You need to identify live hosts, open ports, and the operating systems of the discovered hosts. The client has requested minimal network disruption and wants to avoid crashing any services. Which Nmap scan type is most appropriate for this phase?

   • AUDP scan of all ports with service version detection
   • BPing sweep only, without port scanning
   • CTCP connect scan with aggressive timing and all ports
   • DSYN scan with OS detection and version detection enabled
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   You are mapping a target network that uses a load balancer in front of multiple web servers. You need to identify the individual servers behind the load balancer. Which technique is most effective?

   • AUse traceroute to the load balancer's IP address to see the path.
   • BSend HTTP requests with different Host headers and observe differences in responses.
   • CUse Nmap to scan the load balancer's IP for open ports.
   • DUse DNS enumeration to find multiple A records for the same hostname.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   You are performing reconnaissance on a client's domain. You have found that the DNS server allows zone transfers. You want to use this to gather a comprehensive list of hostnames and IP addresses. Which technique is most appropriate?

   • AUse a search engine to find subdomains indexed in public pages.
   • BUse the 'dig' command with the 'AXFR' option to request a zone transfer from the DNS server.
   • CPerform a brute-force subdomain enumeration using a wordlist.
   • DUse the 'nslookup' command to query for A records of common hostnames.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   You are leading a penetration test for a client that is highly concerned about data leakage. The client has asked you to identify any sensitive information that is publicly accessible, but they have also instructed you to avoid any technique that could be considered intrusive or that might alert their security team. You have a limited time window and need to prioritize your efforts. Which approach best balances thoroughness with the client's constraints?

   • APerform a social engineering attack by sending phishing emails to employees to gather internal information.
   • BUse a vulnerability scanner to check for known vulnerabilities in the client's web applications.
   • CUse passive OSINT techniques, including search engine queries, metadata analysis of public documents, and social media profiling, and document all findings in a structured report.
   • DRun a full Nmap scan against the client's external IP range to identify all open ports and services.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   You are performing OSINT for a client. You have found a PDF document on their website that contains metadata with the author's username 'jdoe' and the software 'Microsoft Word 2016'. You also found a LinkedIn profile for a 'John Doe' who works at the company. Which additional step would most effectively leverage this information for a social engineering attack?

   • ASend a phishing email to John Doe using his work email address.
   • BSearch for the username 'jdoe' on public forums and code repositories to find more personal information.
   • CDocument the findings and move on to the next target.
   • DUse the software version to search for known vulnerabilities in Microsoft Word.
   Reveal Solution Discussion Select an answer first