Network Mapping & Topology Discovery for Penetration Testing

1. In OpenVAS vulnerability scanning, what does the tool primarily assess?

Physical security weaknesses

Network devices and their security configurations

Social engineering effectiveness

Wireless network encryption

2. Which Nmap output format is best for importing scan results into vulnerability management tools?

Normal format

Grepable format

XML format

Script kiddie format

3. In network topology discovery, what does a firewall typically appear as?

A single host with filtered ports

A boundary device controlling traffic between network segments

An application running on a server

A wireless access point

4. Which scanning methodology should be used when stealth is a priority during reconnaissance?

Aggressive scanning with maximum speed

UDP scanning on all ports

Slow, distributed scans with randomized timing

Broadcasting scans across subnets

5. What is the primary difference between a full port scan and a quick scan in Nmap?

Full scans check all 65,535 ports; quick scans check common ports only

Quick scans are more accurate

Full scans detect vulnerabilities; quick scans detect services

There is no functional difference

6. Which reconnaissance technique involves searching public records and social media for employee information?

Active scanning

Social engineering

OSINT

Vulnerability assessment

7. In vulnerability scanning, what does a CVSS score represent?

The number of vulnerabilities found

The severity and impact rating of a vulnerability

The time required to patch a system

The percentage of network coverage scanned

8. Which tool can be used to perform ARP scanning to discover hosts on the local network segment?

Dig

Arp-scan

Whois

Curl

9. What is the main purpose of network enumeration in penetration testing?

To count the number of users on the network

To identify all active hosts, services, and network resources

To monitor bandwidth usage

To block unauthorized access

10. Which protocol is used by Nmap for host discovery when ICMP is blocked?

DNS queries

TCP ACK probes

UDP packets

All of the above

11. Which tool is commonly used for passive DNS reconnaissance to discover subdomains and DNS records?

Nmap

Shodan

TheHarvester

Wireshark

12. What does the -sV flag in Nmap accomplish?

Performs a SYN scan

Detects service versions on open ports

Enables verbose output

Scans for vulnerabilities

13. Which vulnerability scanner is designed to identify missing patches and configuration weaknesses?

Metasploit

Nessus

Burp Suite

Hashcat

14. What is banner grabbing in the context of information gathering?

Stealing promotional materials from a website

Extracting service version and OS information from open ports

Capturing network packets with Wireshark

Phishing users for credentials

15. Which tool is used to perform traceroute and map network hops to a target?

Netstat

Tracert or Traceroute

Arp-scan

Dig

16. In network mapping, what is a topology diagram primarily used for?

Identifying firewall rules

Visualizing network architecture and device relationships

Measuring bandwidth utilization

Encrypting network traffic

17. Which scanning technique uses ICMP echo requests to determine if hosts are online?

Port scanning

Ping sweep

Service enumeration

Vulnerability assessment

18. What does OSINT stand for in the context of penetration testing?

Open Source Intelligence

Operational Security Intelligence

Online System Integration Network

Offensive Security Information Network

19. Which Nmap scan type sends TCP SYN packets and waits for responses without completing the connection?

TCP Connect scan

SYN stealth scan

UDP scan

ACK scan

20. What is the primary advantage of using passive information gathering over active scanning?

It is faster and more efficient

It leaves minimal traces and avoids detection

It provides more detailed vulnerability data

It requires no tools or special knowledge

PenTest+ V2 Network Mapping and Topology Discovery Quiz