eJPT Information Gathering and Reconnaissance 4 — Questions and Answers
Question 1: What is the purpose of the `-A` flag in Nmap?
- Scan all ports from 1-65535
- Enable aggressive mode: OS detection, version detection, scripts, and traceroute (Correct answer)
- Use ACK probes only
- Perform ARP scanning on local network
Correct answer: Enable aggressive mode: OS detection, version detection, scripts, and traceroute
Nmap's `-A` flag enables aggressive scanning including OS detection (`-O`), version detection (`-sV`), script scanning (`-sC`), and traceroute.
Question 2: A DNS MX record is used to identify which of the following?
- The IP address of the web server
- Mail exchange servers responsible for email delivery (Correct answer)
- The authoritative name server for the domain
- The canonical name for an alias
Correct answer: Mail exchange servers responsible for email delivery
MX (Mail Exchange) records specify the mail servers responsible for receiving email for a domain.
Question 3: Which technique involves impersonating a vendor calling an employee to extract information about internal systems?
- Phishing
- Vishing
- Pretexting (Correct answer)
- Tailgating
Correct answer: Pretexting
Pretexting involves creating a fabricated scenario (pretext) — such as impersonating a vendor — to manipulate someone into revealing information.
Question 4: When running `nmap -p 1-1000 192.168.1.1`, what range of ports is scanned?
- All 65535 ports
- Top 1000 most common ports
- Ports 1 through 1000 (Correct answer)
- Only port 1000
Correct answer: Ports 1 through 1000
The `-p 1-1000` flag explicitly instructs Nmap to scan TCP ports 1 through 1000 on the target.
Question 5: What does the acronym OSINT stand for?
- Online Security Intelligence Network Testing
- Open Source Intelligence (Correct answer)
- Operational System Intrusion Techniques
- Organized Scanning and Information Networking Tool
Correct answer: Open Source Intelligence
OSINT stands for Open Source Intelligence — information gathered from publicly available sources.
Question 6: A tester notices TCP port 25 is open on a target server. What service is most likely running?
- HTTP web server
- FTP file transfer
- SMTP email server (Correct answer)
- SSH remote access
Correct answer: SMTP email server
Port 25 is the standard port for SMTP (Simple Mail Transfer Protocol), used for sending email.
Question 7: Which of the following best describes the difference between active and passive reconnaissance?
- Active uses automated tools; passive is manual
- Active directly interacts with the target; passive collects information without touching the target (Correct answer)
- Active is legal; passive is illegal
- Active takes more time; passive is faster
Correct answer: Active directly interacts with the target; passive collects information without touching the target
Active reconnaissance involves direct interaction with target systems (e.g., port scanning), while passive uses publicly available data without contacting the target.
eJPT Information Gathering and Reconnaissance 4
What is the purpose of the `-A` flag in Nmap?