LabYard_

Information Gathering

Answer all 15 questions, then submit. You need 75% to pass. If you don't pass, the reattempt unlocks after 24 hours.

Q1. Reverse IP lookup is used to find:

Other sites hosted on the same address The SSL cipher The domain registrar The MX record

Q2. The site: search operator restricts results to:

A file format A date range A country A single domain or subdomain

Q3. What is reconnaissance?

The information-gathering stage of ethical hacking A malware type The final reporting stage A password storage method

Q4. SNMP with the default community string public allows an attacker to:

Change the MAC address Reboot the router remotely Decrypt TLS Read device configuration and interface details

Q5. Search engines may reveal:

Only firewall passwords Technology platforms and employee details Only RAM size Only CPU temperature

Q6. A WHOIS query can return:

Only browser history Only malware hashes Domain owner contact details and domain information Only CPU usage

Q7. ARP operates at which layer, and within what boundary?

Layer 2, within a single broadcast domain Layer 4, per TCP session Layer 3, across routers Layer 7, across the internet

Q8. The Wayback Machine helps a tester by:

Cracking hashes Scanning ports Showing pages, paths and files that were removed from the live site Sniffing traffic

Q9. DNS enumeration commonly seeks:

Firewall rules Password policies Patch levels Name servers, mail servers and host records for the domain

Q10. A network tester should agree rate limits with the client mainly to:

Improve accuracy of banners Reduce disk usage Avoid knocking fragile production systems offline Bypass the IDS

Q11. Which port does DNS use for ordinary queries?

67 123 161 53

Q12. The dark web is described as:

A private LAN The public web homepage A subset of the deep web requiring a specific browser such as Tor An email protocol

Q13. Public code repositories are a recon target because commits may expose:

API keys, credentials and internal hostnames Design mockups Compiled binaries Only documentation

Q14. Which nmap flag performs service and version detection?

-sn -oN -Pn -sV

Q15. DNS footprinting gathers information about:

DNS servers and DNS records Only physical locations Only passwords Only email bodies

LabYard · hands-on security & data training · flags look like ctflab{...}