EC-Council ECSA Practice Exam | Penetration Testing, OSINT &
Vulnerability Assessment Questions and answers 2026/2027
Question 1
What is the primary purpose of Open Source Intelligence (OSINT)
gathering during the initial phase of a penetration test?
• A. To exploit active vulnerabilities on enterprise database servers.
• B. To collect publicly available information about a target
organization and its employees to identify potential attack vectors
without interacting directly with target systems.
• C. To crack WPA2 Wi-Fi pre-shared keys using rainbow tables.
• D. To decrypt SSL/TLS traffic in real-time.
Correct Answer: B. To collect publicly available information about a
target organization and its employees to identify potential attack
vectors without interacting directly with target systems.
Detailed Rationale: OSINT relies entirely on legal, publicly accessible
data sources (social media, public records, DNS registries, corporate
filings) to build a comprehensive profile of the target without triggering
intrusion detection alarms.
Question 2
What is the function of the theHarvester tool in information gathering?
• A. To brute-force SSH login credentials on remote servers.
, • B. To gather emails, subdomains, hosts, and employee names
from public sources like search engines, PGP key servers, and
Shodan.
• C. To inject SQL queries into web application forms.
• D. To scan local networks for active ARP hosts.
Correct Answer: B. To gather emails, subdomains, hosts, and employee
names from public sources like search engines, PGP key servers, and
Shodan.
Detailed Rationale: theHarvester is a standard OSINT tool designed to
help penetration testers quickly harvest email addresses and
subdomain structures associated with a target domain from public
search indices.
Question 3
How does Maltego visualize OSINT data during reconnaissance?
• A. By rendering complex graphs and relationship links between
entities such as domains, email addresses, infrastructure,
individuals, and organizations.
• B. By generating cryptographic hash signatures for executable
files.
• C. By compiling C++ source code for Linux privilege escalation.
• D. By capturing WPA handshakes from wireless access points.
Correct Answer: A. By rendering complex graphs and relationship links
between entities such as domains, email addresses, infrastructure,
individuals, and organizations.
,Detailed Rationale: Maltego uses transform technology to query
various public databases and APIs, displaying the interconnected
relationships visually as nodes and edges on an interactive graph.
Question 4
What is the primary utility of Shodan in security assessments?
• A. A search engine for internet-connected devices (IoT, routers,
servers, industrial control systems) that allows testers to discover
exposed infrastructure and banner details.
• B. A local password cracking utility for Hashcat.
• C. A web application fuzzer for finding directory traversal flaws.
• D. A packet analyzer for Bluetooth Low Energy (BLE) devices.
Correct Answer: A. A search engine for internet-connected devices (IoT,
routers, servers, industrial control systems) that allows testers to
discover exposed infrastructure and banner details.
Detailed Rationale: Unlike Google which indexes web pages, Shodan
indexes device banners, open ports, and services connected directly to
the public internet, making it invaluable for external infrastructure
reconnaissance.
Question 5
What is Google Dorking (Advanced Google Searching) used for in
penetration testing?
• A. Exploiting buffer overflows in Apache web servers.
, • B. Using advanced operators (like site:, filetype:, intitle:) to
unearth sensitive files, exposed admin panels, directory listings,
and configuration errors indexed by search engines.
• C. Cracking MD5 password hashes via brute force.
• D. Intercepting proxy traffic on local subnets.
Correct Answer: B. Using advanced operators (like site:, filetype:,
intitle:) to unearth sensitive files, exposed admin panels, directory
listings, and configuration errors indexed by search engines.
Detailed Rationale: Google Dorking leverages specific search query
syntax to locate inadvertently published configuration files, database
backups, and login interfaces on target domains.
Question 6
What is the purpose of performing WHOIS queries during
reconnaissance?
• A. To retrieve domain registration details, administrative contact
emails, registrar information, and authoritative name servers
associated with a target domain.
• B. To check CPU temperature on remote servers.
• C. To decode JSON web tokens.
• D. To scan open TCP ports on firewall perimeters.
Correct Answer: A. To retrieve domain registration details,
administrative contact emails, registrar information, and authoritative
name servers associated with a target domain.
Vulnerability Assessment Questions and answers 2026/2027
Question 1
What is the primary purpose of Open Source Intelligence (OSINT)
gathering during the initial phase of a penetration test?
• A. To exploit active vulnerabilities on enterprise database servers.
• B. To collect publicly available information about a target
organization and its employees to identify potential attack vectors
without interacting directly with target systems.
• C. To crack WPA2 Wi-Fi pre-shared keys using rainbow tables.
• D. To decrypt SSL/TLS traffic in real-time.
Correct Answer: B. To collect publicly available information about a
target organization and its employees to identify potential attack
vectors without interacting directly with target systems.
Detailed Rationale: OSINT relies entirely on legal, publicly accessible
data sources (social media, public records, DNS registries, corporate
filings) to build a comprehensive profile of the target without triggering
intrusion detection alarms.
Question 2
What is the function of the theHarvester tool in information gathering?
• A. To brute-force SSH login credentials on remote servers.
, • B. To gather emails, subdomains, hosts, and employee names
from public sources like search engines, PGP key servers, and
Shodan.
• C. To inject SQL queries into web application forms.
• D. To scan local networks for active ARP hosts.
Correct Answer: B. To gather emails, subdomains, hosts, and employee
names from public sources like search engines, PGP key servers, and
Shodan.
Detailed Rationale: theHarvester is a standard OSINT tool designed to
help penetration testers quickly harvest email addresses and
subdomain structures associated with a target domain from public
search indices.
Question 3
How does Maltego visualize OSINT data during reconnaissance?
• A. By rendering complex graphs and relationship links between
entities such as domains, email addresses, infrastructure,
individuals, and organizations.
• B. By generating cryptographic hash signatures for executable
files.
• C. By compiling C++ source code for Linux privilege escalation.
• D. By capturing WPA handshakes from wireless access points.
Correct Answer: A. By rendering complex graphs and relationship links
between entities such as domains, email addresses, infrastructure,
individuals, and organizations.
,Detailed Rationale: Maltego uses transform technology to query
various public databases and APIs, displaying the interconnected
relationships visually as nodes and edges on an interactive graph.
Question 4
What is the primary utility of Shodan in security assessments?
• A. A search engine for internet-connected devices (IoT, routers,
servers, industrial control systems) that allows testers to discover
exposed infrastructure and banner details.
• B. A local password cracking utility for Hashcat.
• C. A web application fuzzer for finding directory traversal flaws.
• D. A packet analyzer for Bluetooth Low Energy (BLE) devices.
Correct Answer: A. A search engine for internet-connected devices (IoT,
routers, servers, industrial control systems) that allows testers to
discover exposed infrastructure and banner details.
Detailed Rationale: Unlike Google which indexes web pages, Shodan
indexes device banners, open ports, and services connected directly to
the public internet, making it invaluable for external infrastructure
reconnaissance.
Question 5
What is Google Dorking (Advanced Google Searching) used for in
penetration testing?
• A. Exploiting buffer overflows in Apache web servers.
, • B. Using advanced operators (like site:, filetype:, intitle:) to
unearth sensitive files, exposed admin panels, directory listings,
and configuration errors indexed by search engines.
• C. Cracking MD5 password hashes via brute force.
• D. Intercepting proxy traffic on local subnets.
Correct Answer: B. Using advanced operators (like site:, filetype:,
intitle:) to unearth sensitive files, exposed admin panels, directory
listings, and configuration errors indexed by search engines.
Detailed Rationale: Google Dorking leverages specific search query
syntax to locate inadvertently published configuration files, database
backups, and login interfaces on target domains.
Question 6
What is the purpose of performing WHOIS queries during
reconnaissance?
• A. To retrieve domain registration details, administrative contact
emails, registrar information, and authoritative name servers
associated with a target domain.
• B. To check CPU temperature on remote servers.
• C. To decode JSON web tokens.
• D. To scan open TCP ports on firewall perimeters.
Correct Answer: A. To retrieve domain registration details,
administrative contact emails, registrar information, and authoritative
name servers associated with a target domain.
