Ethical Hacking: Penetration Testing Methodology Quiz

Quiz: Reconnaissance

Pass mark: 70%. You can retry as many times as you need.

1 What best defines OSINT in a penetration testing context? Single answer Trying default passwords on public login pages Collecting and analysing information that is already publicly available Scanning all ports of a target as fast as possible

2 Which of these are examples of passive subdomain discovery? (several answers) Multiple answers possible Searching certificate transparency logs for a domain Attempting a DNS zone transfer against the target's name server Looking at subdomains indexed by search engines Running a dictionary-based subdomain brute force against the target

3 What does a SYN scan do differently from a full TCP connect scan? Single answer It completes the full handshake before closing the connection cleanly It only works on UDP ports It sends only the first part of the handshake and infers the result from the reply

4 Why should a version number read from a banner never be reported as a confirmed fact without further checks? Single answer Because banners are always encrypted and unreadable Because a banner can be outdated, altered, hidden, or belong to a decoy service Because Nmap cannot read banners at all

5 Which practices are consistent with a professional, lawful reconnaissance phase? (several answers) Multiple answers possible Scanning only hosts explicitly listed in the authorised scope Reporting an urgently exposed credential immediately, before the final report Scanning a real organisation from a home connection out of curiosity Treating every version guess from a scan as a confirmed, reportable fact