Reconnaissance GPEN Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   You are planning a social engineering engagement as part of a penetration test. You need to gather information about employees to craft a convincing pretext. However, the client has strict privacy policies and has asked you to avoid collecting any personal data that is not directly relevant to the engagement. You need to balance the need for information with the client's privacy constraints. Which approach is most appropriate?

   • ACollect as much personal information as possible, including home addresses and personal phone numbers, to make the pretext more convincing.
   • BUse a tool like 'theHarvester' to gather all email addresses and employee names, regardless of relevance.
   • CSkip social engineering reconnaissance and rely solely on technical vulnerabilities.
   • DCollect only job titles, work email addresses, and professional social media profiles that are publicly available and directly relevant to the engagement.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Why is documentation of reconnaissance findings important?

   • AIt helps the tester avoid detection by the target
   • BIt replaces the need for active scanning
   • CIt provides a record of information that can be used in later phases of the penetration test
   • DIt is required by law for all penetration tests
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   You are performing a penetration test and have identified a service running on a non-standard port. You need to determine the exact service and version, but the service does not display a banner when you connect with Netcat. You suspect the service may be using a protocol that does not send a banner until a specific command is sent. Which technique is most appropriate?

   • AUse Nmap's service version detection with the '-sV' flag, which sends a series of probes to elicit a response from the service.
   • BPerform a full port scan to see if the service is also running on a standard port where it might display a banner.
   • CUse Netcat to send a series of common commands (e.g., 'HELP', 'STATUS') to try to get the service to reveal its version.
   • DUse a vulnerability scanner to identify the service based on its response to exploit attempts.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In the penetration testing process, what is the primary purpose of the reconnaissance phase?

   • ATo exploit identified weaknesses and gain initial access to the target
   • BTo identify and document potential vulnerabilities in the target environment
   • CTo gather information about the target to inform subsequent attack planning
   • DTo remove traces of the penetration test from target systems and logs
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Why is service and version detection important during reconnaissance?

   • AIt maps the network path to the target
   • BIt identifies the physical location of the target server
   • CIt reveals specific software versions that may have known vulnerabilities
   • DIt helps identify the operating system of the target
   Reveal Solution Discussion Select an answer first