Reconnaissance GPEN Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   You are performing an external penetration test for a client. The client has a strict change-management policy: any scan that might crash a service must be avoided. You have identified a web server that appears to be running on a non-standard port. You need to confirm the service and version without risking a crash. Which approach is most appropriate?

   • ARun a full Nmap SYN scan with -sV and --version-intensity 9 against all ports on the host.
   • BPerform a TCP connect scan to the specific port and read the banner.
   • CUse a UDP scan on the specific port to avoid TCP-based crashes.
   • DUse Nmap with -sV and --version-light to probe the specific non-standard port with a limited set of probes.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   You are performing banner grabbing on a target's SMTP service. You connect to port 25 and receive the banner: '220 mail.target.com ESMTP Postfix (Ubuntu)'. What additional step should you take to maximize the value of this information for later vulnerability research?

   • AImmediately search the internet for exploits based on the banner.
   • BRecord the banner verbatim in your reconnaissance notes, including the timestamp and source IP.
   • CClose the connection and move on to the next port.
   • DIssue the 'EHLO' command to elicit extended SMTP capabilities and potentially reveal more version details.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   You are in the early stages of a penetration test. The client has asked you to be as stealthy as possible to avoid alerting their security monitoring team. You need to gather initial information about the target's external infrastructure without sending any packets directly to their systems. Which approach is most appropriate?

   • AUse passive OSINT techniques such as DNS lookups, WHOIS queries, and search engine searches.
   • BPerform a traceroute to the target to map the network path.
   • CRun an Nmap SYN scan against the target's IP range to identify open ports.
   • DUse a vulnerability scanner to check for known vulnerabilities in the target's web application.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which of the following is a characteristic of passive reconnaissance?

   • AIt involves sending packets to the target to observe responses
   • BIt requires prior authorization from the target organization
   • CIt relies on publicly available information without directly interacting with the target
   • DIt is more likely to be detected by intrusion detection systems
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   You are conducting a network penetration test. After identifying a live host, you need to determine which ports are open and which services are running on those ports. You want to gather this information in a single pass to save time. Which technique is most appropriate?

   • AUse the 'ping' command to check which ports are open.
   • BUse a web browser to access the host's IP address and see which services are running.
   • CUse Nmap with the '-sV' flag to perform service version detection on all open ports.
   • DUse Netcat to manually connect to each port and read the banner.
   Reveal Solution Discussion Select an answer first