Reconnaissance and Mapping GWAPT Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A penetration tester is beginning an assessment of a client's web application. The client has asked the tester to avoid any direct interaction with the target systems until the initial information-gathering phase is complete. The tester needs to build a preliminary profile of the organization's internet-facing infrastructure. Which approach best satisfies the client's constraint?

   • ARun a full Nmap SYN scan against the organization's public IP range to identify open ports and services.
   • BSend crafted HTTP requests to the main website to observe server headers and error pages.
   • CQuery WHOIS records, DNS TXT/NS records, and search-engine caches to compile domain and hosting details.
   • DUse a directory brute-forcing tool against the discovered hostnames to enumerate hidden paths.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A penetration tester is planning the reconnaissance phase for a web application that is hosted in a cloud environment. The client has strict rules of engagement: no active scanning between 9 AM and 5 PM local time, and no techniques that could cause a denial of service. The tester needs to gather as much information as possible before the active window. Which plan is most effective?

   • ASkip passive reconnaissance and wait for the evening to perform all active scanning.
   • BUse a distributed scanning service to perform active scans during the day without detection.
   • CRun a fast Nmap scan during the day because it is unlikely to cause a denial of service.
   • DPerform extensive passive reconnaissance during the day, then schedule active scanning for the evening when allowed.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which tool is commonly used to automate the discovery of web application content by brute-forcing directories and files?

   • AGobuster
   • BWireshark
   • CMetasploit
   • DNmap
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which HTTP response header is commonly used to identify the web server software and version?

   • AContent-Type
   • BX-Powered-By
   • CServer
   • DSet-Cookie
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   Which of the following activities is an example of passive reconnaissance in a web application penetration test?

   • AUsing a directory brute-forcing tool to find hidden paths
   • BReviewing the target's DNS records and WHOIS information
   • CSending a crafted HTTP request to the target to see how it responds
   • DRunning a port scan against the target's IP range
   Reveal Solution Discussion Select an answer first