eJPT Information Gathering and Reconnaissance — Questions and Answers
Question 1: What is the primary purpose of passive reconnaissance in penetration testing?
- To exploit vulnerabilities directly
- To gather information without directly interacting with the target (Correct answer)
- To install backdoors
- To conduct social engineering
Correct answer: To gather information without directly interacting with the target
Passive reconnaissance collects information about a target without direct interaction, reducing the chance of detection.
Question 2: Which tool is commonly used for DNS enumeration during information gathering?
- Metasploit
- nslookup and dig (Correct answer)
- Burp Suite
- Wireshark
Correct answer: nslookup and dig
nslookup and dig are standard DNS query tools used to enumerate DNS records and discover subdomains during reconnaissance.
Question 3: What is OSINT in the context of penetration testing?
- A type of exploit
- Open Source Intelligence gathering from publicly available information (Correct answer)
- A network protocol
- A type of malware
Correct answer: Open Source Intelligence gathering from publicly available information
OSINT involves collecting intelligence from publicly available sources such as websites, social media, and public records.
Question 4: What type of information does a WHOIS lookup provide?
- Server vulnerabilities
- Domain registration details including registrant and contact information (Correct answer)
- Network traffic data
- Password hashes
Correct answer: Domain registration details including registrant and contact information
WHOIS lookups reveal domain registration information including registrant details, nameservers, and registration dates.
Question 5: What is the purpose of port scanning during active reconnaissance?
- To crash services
- To identify open ports and running services on target systems (Correct answer)
- To encrypt traffic
- To delete logs
Correct answer: To identify open ports and running services on target systems
Port scanning identifies open ports and running services, revealing the attack surface and potential entry points.
Question 6: Which reconnaissance technique involves examining website source code and headers?
- Brute force attack
- Web application fingerprinting (Correct answer)
- Password spraying
- Privilege escalation
Correct answer: Web application fingerprinting
Web application fingerprinting examines HTTP headers, source code, and responses to identify technologies and versions in use.
eJPT Information Gathering and Reconnaissance
What is the primary purpose of passive reconnaissance in penetration testing?