NEW
Font size
WorksheetsChapter 5: Reconnaissance and Intelligence Gathering
Total questions: 20
Worksheet time: 20mins
Megan wants to use the Metasploit Framework to conduct a web application vulnerability scan. What module from the following list is best suited to her needs?
smb_login
Angry IP
nmap
wmap
What flag does nmap use to enable operating system identification?
–os
–id
–O
–osscan
What command-line tool can be used to determine the path that traffic takes to a remote system?
Whois
traceroute
nslookup
routeview
Valerie wants to use a graphical interface to control nmap and wants to display her scans as a visual map to help her understand her target networks. What tool from the following list should she use?
Angry IP Scanner
wmap
Zenmap
nmap-gs
Susan runs an nmap scan using the following command: nmap -O -Pn 192.168.1.0/255
What information will she see about the hosts she scans?
The hostname and service ports
The hostname, service ports, and operating system
The hostname and operating system
The hostname, uptime, and logged-in user
Tuan wants to gather additional information about a domain that he has entered in Maltego. What functionality is used to perform server-based actions in Maltego?
A worker
A query
A transform
A scan
Laura wants to conduct a search for hosts using Recon-ng but wants to leverage a search engine with API access to acquire existing data. What module should she use?
recon/companies-multi/whois_miner
import/nmap
recon/domains-hosts/shodan_hostname
import/list
After running an nmap scan, Geoff sees ports 80 and 443 open on a system he scanned. What reasonable guess can he make about the system based on this result?
The system is a Windows system.
The system is running a database server.
The system is a Linux system.
The system is running a web server.
What information is used to identify network segments and topology when conducting an nmap scan?
IP addresses
Hostnames
Time to live
Port numbers
Murali wants to scan a network using nmap and has run a scan without any flags without discovering all of the hosts that he thinks should show. What scan flag can he use to scan without performing host discovery that will also determine if services are open on the systems?
-sn
-PS
-Pn
-sL
Jaime is using the Angry IP Scanner and notices that it supports multiple types of pings to identify hosts. Why might she choose to use a specific type of ping over others?
To bypass firewalls
To allow better vulnerability detection
To prevent the scan from being flagged by DDoS protection tools
To leverage the faster speed of TCP pings over UDP pings
Hue wants to perform network footprinting as part of a reconnaissance effort. Which of the following tools is best suited to passive footprinting given a domain name as the starting point for her efforts?
Traceroute
Maltego
Nmap
Angry IP Scanner
Jack wants to scan a system using the Angry IP Scanner. What information does he need to run the scan?
The system's IP address
The system's Whois data
The system's MAC address
The system administrator's username and password
Which of the following is not a reason that security professionals often perform packet capture while conducting port and vulnerability scanning?
Work process documentation
To capture additional data for analysis
To prevent external attacks
To provide a timeline
What process uses information such as the way that a system's TCP stack responds to queries, what TCP options it supports, and the initial window size it uses?
Service identification
Fuzzing
Application scanning
OS detection
Li wants to use Recon-ng to gather data from systems. Which of the following is not a common use for Recon-ng?
Conducting vulnerability scans of services
Looking for sensitive files
Conducting OSINT gathering of Whois, DNS, and similar data
Finding target IP addresses
Jason wants to conduct a port scan using the Metasploit Framework. What tool can he use from the framework to do this?
Angry IP Scanner
Recon-ng
Maltego
Nmap
Sally wants to use operating system identification using nmap to determine what OS a device is running. Which of the following is not a datapoint used by nmap to identify operating systems?
TCP sequences
TCP timestamps
TCP OS header
TCP options
Chris wants to perform network-based asset discovery. What limitation will he encounter if he relies on a port scanner to perform his discovery?
Port scanners cannot detect vulnerabilities.
Port scanners cannot determine what services are running on a given port.
Firewalls can prevent port scanners from detecting systems.
A port scanner can create a denial-of-service condition for many modern systems.
Emily wants to gather open source intelligence and centralize it using an open source tool. Which of the following tools is best suited to managing the collection of data for her OSINT efforts?
The Metasploit Framework
Recon-ng
nmap
Angry IP Scanner
