PenTest+ Reconnaissance and Enumeration: 183 practice questions

12 of the 183 Reconnaissance and Enumeration questions in the Certsqill PenTest+ bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for PenTest+? Take the free 5-min readiness check →

1. nmap -sn 198.51.100.0/24: Which Nmap command meets that requirement?

1. nmap -Pn 198.51.100.0/24

   -Pn skips host discovery, so it does not perform the requested responsiveness check.
2. nmap -sV 198.51.100.0/24

   -sV probes reachable ports for service versions, exceeding the stated host-discovery requirement.
3. nmap -sS 198.51.100.0/24

   -sS performs SYN port scanning rather than host discovery without port scanning.
4. nmap -sn 198.51.100.0/24 ✓

   Nmap -sn performs host discovery without conducting a port scan, matching the stated assessment requirement.

Nmap -sn performs host discovery without conducting a port scan.

2. 28: What integer does it print?

1. 30

   This total miscalculates the qualifying values after applying the greater-than-or-equal filter.
2. 28 ✓

   The qualifying values are 5, 9, 7, 4, and 3, whose sum is 28.
3. 29

   This value results from adding an element that does not satisfy the filter condition.
4. 25

   This value omits one qualifying list element from the sum.

The qualifying values sum to 28.

3. Passive reconnaissance because the assessor used only: Which reconnaissance classification best fits this acti

1. Active reconnaissance because the results identify systems that may be reachable.

   The nature of the discovered information does not make collection active; classification depends on whether the target received traffic.
2. Active reconnaissance because searching an archive is equivalent to probing services on the discovered hosts.

   Archive searching retrieves existing records and does not probe services on the discovered hosts.
3. Active reconnaissance because querying public services is interaction with the target organization.

   The queried services were third-party public sources, and the assessor did not directly contact the organization's systems.
4. Passive reconnaissance because the assessor used only existing public records without contacting the target. ✓

   Certificate-transparency and archival records were consulted without sending traffic to the retail environment.

This is passive reconnaissance because only existing public records were consulted without contacting the target.

4. Nmap -O: Which tool and feature best match the requirement?

1. Nmap -O ✓

   Nmap -O performs OS detection from target responses, while its result remains probabilistic and should be validated.
2. Maltego

   Maltego maps relationships among entities and does not perform the requested target-response OS detection.
3. Wireshark

   Wireshark analyzes captured packets but does not itself provide the requested Nmap-style OS fingerprint feature.
4. Amass

   Amass supports domain discovery and enumeration, not the requested response-based operating-system fingerprint.

Nmap -O matches the requirement for probabilistic operating-system detection.

5. Ensure selected ports answer probes: Which missing prerequisite most directly explains the result?

1. Obtain an operating-system fingerprint before service probing begins.

   OS detection with `-O` may provide context but is not a prerequisite for `-sV`.
2. Query certificate-transparency records for names associated with the fictional host.

   Certificate-transparency records may reveal certificate names but do not make listening services answer Nmap probes.
3. Ensure selected ports answer probes. ✓

   Nmap service-version detection requires selected ports to be reachable and responsive to its probes.
4. Collect a wireless packet capture from the host's surrounding radio channel.

   Packet capture can provide traffic evidence but is not required for Nmap's active service-version probes.

Service detection requires reachable selected ports that answer probes.

6. 4: What integer does it print?

1. 6

   Six counts the original list elements without removing duplicate values.
2. 2

   Two counts repeated-value groups rather than all distinct values in the list.
3. 3

   Three omits one of the distinct values present in the list.
4. 4 ✓

   The set contains the four distinct values 8, 1, 3, and 4.

The set contains four distinct values.

7. The names appeared in issued certificates: What conclusion is best supported by this observation?

1. The organization definitely owns every discovered name and address.

   Certificate names provide clues but do not conclusively establish ownership of every name or address.
2. The certificates prove the service is vulnerable because staging names were included.

   A certificate name is an infrastructure clue, not evidence that a service has a vulnerability.
3. All listed hosts are currently reachable but hidden by DNS.

   The observation does not prove reachability, and absent DNS results have multiple possible explanations.
4. The names appeared in issued certificates, not that the hosts are live. ✓

   Certificate-transparency records show certificate names and do not establish current DNS resolution or host reachability.

The names appeared in issued certificates, not that the hosts are live.

8. An open port shows a listener: Which statement best makes that distinction?

1. The port number alone reliably identifies the running application.

   Applications can use nonstandard ports, so a port number does not prove service identity.
2. A port is the application service itself.

   A port identifies a transport endpoint; the application service listens through that endpoint.
3. An open port shows a listener; probes identify the service. ✓

   An open result indicates a reachable listener, while service detection provides additional application and version evidence.
4. Every open port proves the advertised service is securely configured.

   An open result shows reachability and a listener, not secure configuration or absence of vulnerabilities.

Open ports show reachable listeners; service detection separately identifies likely application protocols or software.

9. Use `-sT`; it uses the OS TCP connect call as the fallback: What is the strongest supported conclusion?

1. Use `-Pn` because it performs a TCP connect scan.

   `-Pn` skips host discovery; it does not select TCP connect scanning or replace `-sT`.
2. The target must be down because SYN scanning failed locally.

   A local packet-creation limitation cannot establish that the remote target is unavailable.
3. Use `-sT`; it uses the OS TCP connect call as the fallback. ✓

   `-sT` uses the operating system's TCP connect mechanism and is appropriate when raw-packet privileges needed by SYN scanning are unavailable.
4. Use `-sU` because raw-packet privileges are unavailable.

   `-sU` changes the scan to UDP and does not provide a TCP fallback for missing raw-packet privileges.

Nmap `-sT` uses TCP connect calls when SYN scanning lacks required privileges.

10. Safely convert it: What should the validator do before evaluating that condition?

1. Retry the comparison until the supplied value satisfies the condition.

   Retries do not correct the type issue or establish bounded input validation.
2. Compare the string directly with numeric bounds.

   The input is text and has not yet been safely converted or validated as an integer.
3. Convert the value and accept every resulting integer.

   Conversion does not enforce the required bounds of 1 through 5.
4. Safely convert it, require an integer from 1 through 5, and reject invalid input. ✓

   Safe conversion, integer validation, inclusive bounds of 1–5, and rejection establish the required condition before comparison.

Safely convert the value, require an integer from 1 through 5, and reject invalid input.

11. The A record is being served from a stale or split-view: What is the stated root cause?

1. The PTR record must be missing and therefore caused the wrong forward lookup.

   PTR records provide reverse mapping and do not cause an incorrect forward A-record response.
2. The NS record proves the application host is compromised.

   An authoritative-server discrepancy identifies a resolution issue, not evidence of host compromise.
3. The MX record is routing web traffic incorrectly.

   MX records identify mail exchange hosts and do not determine the web application's address resolution.
4. The A record is being served from a stale or split-view DNS source. ✓

   The observed address differs from the intended internal address, consistent with stale data or split-view DNS behavior.

The resolver is receiving stale or split-view A-record data from the observed DNS source.

12. Use `ffuf` with a wordlist and `-fs 612`: Which choice best matches the requirement?

1. Use `gobuster dir` with extensions and status-code filtering instead of measuring response size.

   The proposed configuration does not filter the 612-byte custom-not-found body as required.
2. Use `feroxbuster` and filter responses only by status code 404.

   This uses status filtering rather than the explicitly required response-size filter; the displayed 404 responses share the same status.
3. Use `Nikto` for web-server checks.

   Nikto performs web-server and known-issue checks rather than the required wordlist path discovery with size filtering.
4. Use `ffuf` with a wordlist and `-fs 612`. ✓

   `ffuf` supports wordlist path discovery, and `-fs 612` filters responses matching the custom 404 size.

Use `ffuf` with `-fs 612` to suppress the custom 404 baseline.

Other PenTest+ domains

• Attacks and Exploits — 304 questions →
• Vulnerability Discovery and Analysis — 148 questions →
• Post-exploitation and Lateral Movement — 122 questions →
• Engagement Management — 113 questions →
• All 870 PenTest+ questions →
• PenTest+ certification: requirements, cost and exam format →