You are mapping a client's network infrastructure as part of a penetration test. You need to understand the network path from your position to a target server, including any intermediate routers or firewalls that might filter traffic. Which technique is most appropriate for this task?

Perform a DNS zone transfer to get a list of all network devices.

Use traceroute to map the network path and identify intermediate hops.

Query the WHOIS database for the IP address of the target to see the network path.

Use Nmap's OS detection to identify the operating systems of all devices on the path.

You are scanning a target host and need to determine its operating system. The host is behind a firewall that drops most ICMP traffic and appears to have no open TCP ports. Which technique is most likely to provide OS fingerprinting information?

Send ICMP echo requests and analyze the TTL and ICMP error messages.

Use a UDP scan to elicit ICMP port unreachable messages that reveal OS details.

Use Nmap's OS detection (-O) with a SYN scan against common ports.

Perform a passive OS fingerprinting by capturing network traffic from the host.

As part of a penetration test, you are tasked with finding sensitive information about a client that may have been inadvertently exposed through public documents. You have access to the internet and the client's domain name. Which technique is most appropriate for this task?

Use a vulnerability scanner to find SQL injection points in the client's web application.

Use search engines to find documents hosted on the client's domain and analyze their metadata.

Perform a port scan of the client's web server to find hidden directories.

Send a crafted email to the client's IT department to ask for internal documents.

During an authorized penetration test, you are tasked with identifying the technology stack and potential entry points of a target organization before any direct interaction with their systems. You have been given only the company name and its primary website URL. Which approach best aligns with passive reconnaissance while gathering useful technical and personnel information?

Run a full port scan using Nmap with service version detection against the target's public IP range.

Search public job postings, social media profiles, and cached versions of the website to infer technologies and employee roles.

Query the target's DNS servers for A and MX records, then connect to the web server to capture its HTTP banner.

Perform a traceroute to the target's web server to map the network path and identify intermediate devices.

GIAC Penetration Tester (GPEN)

Domain 1Objective 2

Reconnaissance GPEN Practice Questions (Page 3)

Part of the Penetration Testing Foundations domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

12concepts

Questions 11–15

11application · medium
You are mapping a client's network infrastructure as part of a penetration test. You need to understand the network path from your position to a target server, including any intermediate routers or firewalls that might filter traffic. Which technique is most appropriate for this task?
Select an answer first
12application · medium
You are scanning a target host and need to determine its operating system. The host is behind a firewall that drops most ICMP traffic and appears to have no open TCP ports. Which technique is most likely to provide OS fingerprinting information?
Select an answer first
13application · medium
As part of a penetration test, you are tasked with finding sensitive information about a client that may have been inadvertently exposed through public documents. You have access to the internet and the client's domain name. Which technique is most appropriate for this task?
Select an answer first
14application · medium
During an authorized penetration test, you are tasked with identifying the technology stack and potential entry points of a target organization before any direct interaction with their systems. You have been given only the company name and its primary website URL. Which approach best aligns with passive reconnaissance while gathering useful technical and personnel information?
Select an answer first
15foundation · easy
Which Nmap option is used to enable service and version detection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Reconnaissance GPEN Practice Questions (Page 3)

Questions 11–15

You are mapping a client's network infrastructure as part of a penetration test. You need to understand the network path from your position to a target server, including any intermediate routers or firewalls that might filter traffic. Which technique is most appropriate for this task?

You are scanning a target host and need to determine its operating system. The host is behind a firewall that drops most ICMP traffic and appears to have no open TCP ports. Which technique is most likely to provide OS fingerprinting information?

As part of a penetration test, you are tasked with finding sensitive information about a client that may have been inadvertently exposed through public documents. You have access to the internet and the client's domain name. Which technique is most appropriate for this task?

Which Nmap option is used to enable service and version detection?

Keep studying — Penetration Testing Foundations