PenTest+ OSINT Techniques and Tools Quiz

1. What type of information can be gathered from analyzing a target's LinkedIn profiles during OSINT?

Network topology and IP ranges

Employee names, titles, and organizational structure

Database credentials and API keys

Active malware infections

2. Which of the following is a common format for organizing OSINT findings during reconnaissance?

Unstructured free-form notes

Structured asset inventory with IP ranges, domains, and services

Handwritten paper records only

Random database entries

3. What is the primary ethical consideration when conducting OSINT reconnaissance?

Using only paid tools

Staying within the scope of authorized assessment

Avoiding public information sources

Never documenting findings

4. During OSINT, what does analyzing cached versions of a website (via Wayback Machine) help identify?

Current firewall rules

Historical changes, removed content, and past infrastructure

Active user sessions

Encrypted database backups

5. Which tool allows penetration testers to search for subdomains using certificate transparency logs?

Ping

Crt.sh or similar CT search tools

ARP scanner

ICMP traceroute

6. What information does a DNS zone transfer reveal about a target domain?

All DNS records and subdomains

Only the primary nameserver

User login credentials

Active network connections

7. Which protocol is used to retrieve domain registration details in WHOIS queries?

HTTP

SMTP

Port 43 (WHOIS protocol)

FTP

8. Censys is an OSINT platform primarily used to search for which type of information?

Social media usernames

Internet-wide certificate and host data

Leaked password databases

Dark web marketplaces

9. What is the primary risk of using active enumeration techniques during a penetration test?

They are slower than passive techniques

They may trigger security alerts and detection

They require more powerful hardware

They cannot discover listening ports

10. Which of the following best describes footprinting in the context of reconnaissance?

Executing payload code on the target system

Collecting preliminary information about the target organization

Cracking user passwords

Installing backdoors for persistent access

11. Which of the following is a primary advantage of passive reconnaissance over active scanning?

It leaves no traces on target systems

It gathers more detailed information faster

It requires elevated system privileges

It bypasses firewall protections

12. Which OSINT tool is used to identify relationships between entities like people, companies, and domains?

Nmap

Maltego

Hydra

Aircrack-ng

13. What is the primary function of a reverse DNS lookup during reconnaissance?

To convert IP addresses to domain names

To identify all subdomains of a domain

To list all MX records

To verify SSL certificate validity

14. TheHarvester is commonly used to gather which types of information about a target?

Open ports and running services

Email addresses and subdomains

Active user sessions

Encrypted password hashes

15. Which of the following is NOT a typical passive information gathering technique?

Reviewing cached web pages

Analyzing DNS records

Port scanning with Nmap

Searching public databases

16. What is the primary purpose of WHOIS queries during reconnaissance?

To identify running services on a host

To gather domain registration and ownership information

To test network firewall rules

To enumerate user accounts

17. Which reconnaissance technique involves searching Google for sensitive information using advanced operators like 'site:' and 'inurl:'?

Social engineering

Google dorking

WHOIS enumeration

Footprinting

18. Shodan is primarily used for discovering which type of information about target organizations?

Employee social media profiles

Internet-connected devices and their metadata

Website source code vulnerabilities

Network traffic patterns

19. Which tool is commonly used to perform DNS enumeration and gather nameserver information?

Wireshark

Nslookup or dig

Metasploit

Burp Suite

20. What does OSINT stand for in the context of penetration testing?

Offensive Security Information Network

Open Source Intelligence

Operational Security Integration

Online System Information Network