You are conducting a penetration test for a client. The client has provided a signed authorization, but you must minimize direct interaction with the target systems until the final exploitation phase. During the initial phase, you need to identify the client's external IP ranges, employee email formats, and any sensitive documents that may have been inadvertently exposed. Which approach best satisfies these requirements while staying within the authorized scope?

Use a vulnerability scanner to identify weaknesses in the client's web applications.

Perform passive OSINT using search engines, public DNS records, and metadata from publicly accessible documents.

Send phishing emails to employees to gather credentials and internal network information.

Run an active port scan against all IP addresses in the client's ASN to discover live hosts and services.

You are performing a network penetration test for a client. After an initial port scan, you have identified that a host has port 22 open. You need to determine the exact version of the SSH service running to check for known vulnerabilities. Which technique is most appropriate for this task?

Use the 'traceroute' command to map the network path and infer the OS version.

Perform a full TCP connect scan on all ports to see if any other services reveal version information.

Query the DNS server for a TXT record containing the service version.

Use Nmap's service version detection with the '-sV' flag against the specific port.

What is the primary purpose of using OSINT during reconnaissance?

To gather information about a target from publicly available sources

To directly exploit vulnerabilities discovered in public documents

To bypass network security controls without detection

To replace active scanning entirely in all penetration tests

During a penetration test, you have discovered a host with several open ports. You need to determine the operating system of the host to tailor your exploitation attempts. You have network access to the host and can send packets to it. Which technique is most appropriate for OS fingerprinting?

Perform a traceroute to the host and analyze the TTL values to guess the OS.

Use the 'banner' command to grab the OS banner from port 80.

Query the DNS server for an 'OS' record associated with the host.

Use Nmap's OS detection with the '-O' flag, which analyzes TCP/IP stack responses.

GIAC Penetration Tester (GPEN)

Domain 1Objective 2

Reconnaissance GPEN Practice Questions (Page 7)

Part of the Penetration Testing Foundations domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 4–7 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

12concepts

Questions 31–35

31application · medium
You are conducting a penetration test for a client. The client has provided a signed authorization, but you must minimize direct interaction with the target systems until the final exploitation phase. During the initial phase, you need to identify the client's external IP ranges, employee email formats, and any sensitive documents that may have been inadvertently exposed. Which approach best satisfies these requirements while staying within the authorized scope?
Select an answer first
32foundation · easy
Which DNS record type is used to map a hostname to an IPv4 address?
Select an answer first
33application · medium
You are performing a network penetration test for a client. After an initial port scan, you have identified that a host has port 22 open. You need to determine the exact version of the SSH service running to check for known vulnerabilities. Which technique is most appropriate for this task?
Select an answer first
34foundation · easy
What is the primary purpose of using OSINT during reconnaissance?
Select an answer first
35application · medium
During a penetration test, you have discovered a host with several open ports. You need to determine the operating system of the host to tailor your exploitation attempts. You have network access to the host and can send packets to it. Which technique is most appropriate for OS fingerprinting?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Reconnaissance GPEN Practice Questions (Page 7)

Questions 31–35

Which DNS record type is used to map a hostname to an IPv4 address?

You are performing a network penetration test for a client. After an initial port scan, you have identified that a host has port 22 open. You need to determine the exact version of the SSH service running to check for known vulnerabilities. Which technique is most appropriate for this task?

What is the primary purpose of using OSINT during reconnaissance?

During a penetration test, you have discovered a host with several open ports. You need to determine the operating system of the host to tailor your exploitation attempts. You have network access to the host and can send packets to it. Which technique is most appropriate for OS fingerprinting?

Keep studying — Penetration Testing Foundations