Reconnaissance GPEN Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   You are performing reconnaissance on a client's domain. You have found that the DNS server allows zone transfers, but you are concerned that performing a full zone transfer might be considered intrusive and could alert the client's security monitoring. You need to gather as much information as possible while minimizing the risk of detection. Which approach is most appropriate?

   • AUse passive DNS enumeration techniques, such as querying public DNS databases and search engine caches, to gather subdomain information without directly querying the client's DNS server.
   • BPerform the zone transfer using a low-and-slow approach, querying individual records over an extended period to avoid triggering rate-based alerts.
   • CSkip DNS enumeration entirely and rely on port scanning to identify hosts.
   • DPerform the zone transfer normally, as it is a standard DNS query and is unlikely to be monitored.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   You are performing reconnaissance on a target domain and have discovered a subdomain that resolves to an internal IP address (10.10.10.5). You want to identify other internal hostnames that may be mapped to the same IP or reveal additional internal infrastructure. Which DNS enumeration technique is most effective for this purpose?

   • ARun a zone transfer attempt against the authoritative DNS server for the domain.
   • BPerform a reverse DNS lookup on the IP address 10.10.10.5 to find associated PTR records.
   • CUse Nmap to scan the IP address 10.10.10.5 for open ports and services.
   • DQuery the domain's SPF record to identify authorized mail servers.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is a primary advantage of active reconnaissance over passive reconnaissance?

   • AIt can gather more detailed and specific information about the target's systems
   • BIt relies solely on information available from search engines
   • CIt does not require any legal authorization
   • DIt is completely undetectable by the target
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   You are planning a social engineering engagement as part of a penetration test. You need to gather information about key employees, their roles, and their contact details to craft a convincing phishing email. Which technique is most appropriate for this task?

   • AQuery the DNS server for employee records.
   • BUse a tool like 'theHarvester' to search for email addresses, but this only finds technical contacts, not all employees.
   • CSearch social media platforms and the company website for employee names, job titles, and email addresses.
   • DPerform a network scan of the company's IP range to identify employee workstations.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which search engine query operator is used to search for specific file types?

   • Asite:
   • Binurl:
   • Cfiletype:
   • Dintitle:
   Reveal Solution Discussion Select an answer first