Information Gathering & Recon (PenTest+) Quiz

1. Network footprinting involves gathering information about network topology and services. Which of the following is NOT a footprinting activity?

Traceroute analysis

Banner grabbing

Password cracking

Identifying active hosts

2. What is the primary ethical and legal concern when conducting reconnaissance?

Ensuring activities are authorized and within scope

Using the fastest tools available

Avoiding detection by any means

Gathering as much data as possible

3. Which protocol is commonly used for zone transfers in DNS reconnaissance?

HTTP

AXFR (DNS zone transfer)

SMTP

SSH

4. In reconnaissance, what is the primary benefit of using multiple tools and techniques?

To save money on security tools

To cross-reference findings and increase accuracy

To avoid using commercial tools

To confuse the target organization

5. What is a common risk of sharing too much information on social media during reconnaissance?

It increases internet speed

It reduces the target's security posture

It provides attackers with personal and professional details

It prevents phishing attacks

6. Which of the following describes the scope and boundaries of a penetration test?

Rules of Engagement

Vulnerability Assessment

Threat Model

Risk Matrix

7. What is the purpose of reverse DNS lookups in reconnaissance?

To encrypt DNS queries

To map IP addresses to hostnames

To block DNS attacks

To speed up DNS resolution

8. Shodan is a search engine used in reconnaissance. What does it primarily index?

Email addresses

Social media profiles

Internet-connected devices and their services

Leaked password databases

9. Which reconnaissance method involves examining publicly available metadata in documents?

Port scanning

Metadata analysis

Packet sniffing

Brute force enumeration

10. What is banner grabbing in the context of reconnaissance?

Stealing advertising banners from websites

Capturing service version and OS information from open ports

Blocking malicious banners

Creating fake banners for phishing

11. Which of the following is a passive reconnaissance technique that does not send packets to the target?

Port scanning with Nmap

Open Source Intelligence (OSINT)

Ping sweeps

SYN scans

12. Which tool is specifically designed for harvesting email addresses and subdomains from public sources?

Wireshark

TheHarvester

Burp Suite

Metasploit

13. What is the primary advantage of passive reconnaissance over active reconnaissance?

It is faster and more accurate

It leaves minimal traces and avoids triggering security alerts

It provides real-time network topology

It can exploit vulnerabilities directly

14. Google Dorking is a reconnaissance technique that uses advanced Google search operators. Which operator searches for a specific file type?

Site:

Filetype:

Inurl:

Cache:

15. Which scanning technique sends TCP packets with the SYN flag set without completing the three-way handshake?

Full connect scan

UDP scan

Stealth SYN scan

FIN scan

16. What information can be gathered from WHOIS queries?

Real-time network traffic data

Domain registration details and contact information

Employee passwords

Active malware signatures

17. Which of the following is an example of social engineering used in reconnaissance?

Scanning for open ports

Pretexting to extract employee information

Analyzing packet headers

Running vulnerability scans

18. What does OSINT stand for in the context of reconnaissance?

Open System Internet Network Technology

Open Source Intelligence

Operational Security Information Network

Online Surveillance and Intelligence Network

19. Which tool is commonly used for active network reconnaissance and port scanning?

Shodan

Nmap

Google Dorking