GIAC GPEN QUESTIONS AND ANSWERS | VERIFIED
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
Section 1: Planning, Scoping, and Reconnaissance (Questions 1-15)
1. What is the primary purpose of a Rules of Engagement (RoE) document?
A) To define the technical specifications of the target network.
B) To legally authorize the penetration test and define its scope, boundaries, and timeline.
C) To provide a list of all vulnerabilities found during the test.
,D) To outline the tools that will be used by the penetration tester.
Answer: B
Rationale: The RoE is a critical legal and planning document. It protects both the tester and the client by clearly
defining what is authorized, when, and how. It prevents scope creep and legal issues.
2. During a penetration test, you are performing passive reconnaissance. Which of the following activities falls
into this category?
A) Performing a DNS zone transfer.
B) Using Shodan to search for exposed devices.
C) Running an Nmap SYN scan against a target.
D) Conducting a directory brute-force attack on a web server.
Answer: B
Rationale: Passive reconnaissance involves gathering information without directly interacting with the target's
systems. Shodan queries its own database of previously scanned devices. The other options involve direct
interaction with the target.
,3. Which tool is best suited for gathering open-source intelligence (OSINT) by scraping metadata from
documents found on a target's website?
A) Nmap
B) Metasploit
C) FOCA
D) Wireshark
Answer: C
Rationale: FOCA (Fingerprinting Organizations with Collected Archives) is a tool designed specifically to find and
analyze metadata in documents (like PDFs, Word docs) to discover usernames, software versions, and network
paths.
4. What is the purpose of the `whois` command?
A) To determine the geographic location of an IP address.
B) To query databases that store registered users or assignees of an Internet resource.
C) To scan a network for open ports.
D) To intercept and analyze network traffic.
Answer: B
, Rationale: `whois` is used to query domain name registrars and regional internet registries to find information
about the owner of a domain name or IP address block, such as contact information and name servers.
5. You are using `theHarvester` and want to find email addresses associated with a target domain. Which of the
following is a valid data source for this tool?
A) Metasploit
B) Google
C) Nmap
D) John the Ripper
Answer: B
Rationale: `theHarvester` gathers emails, subdomains, hosts, employee names, open ports, and banners from
different public sources like search engines (Google, Bing), PGP key servers, and Shodan.
6. In the context of a penetration test, what is "scope creep"?
A) The gradual expansion of the test's goals beyond the original agreement.
B) A technique for scanning a large network range.
C) The process of escalating privileges on a compromised host.
D) A type of vulnerability in web applications.
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
Section 1: Planning, Scoping, and Reconnaissance (Questions 1-15)
1. What is the primary purpose of a Rules of Engagement (RoE) document?
A) To define the technical specifications of the target network.
B) To legally authorize the penetration test and define its scope, boundaries, and timeline.
C) To provide a list of all vulnerabilities found during the test.
,D) To outline the tools that will be used by the penetration tester.
Answer: B
Rationale: The RoE is a critical legal and planning document. It protects both the tester and the client by clearly
defining what is authorized, when, and how. It prevents scope creep and legal issues.
2. During a penetration test, you are performing passive reconnaissance. Which of the following activities falls
into this category?
A) Performing a DNS zone transfer.
B) Using Shodan to search for exposed devices.
C) Running an Nmap SYN scan against a target.
D) Conducting a directory brute-force attack on a web server.
Answer: B
Rationale: Passive reconnaissance involves gathering information without directly interacting with the target's
systems. Shodan queries its own database of previously scanned devices. The other options involve direct
interaction with the target.
,3. Which tool is best suited for gathering open-source intelligence (OSINT) by scraping metadata from
documents found on a target's website?
A) Nmap
B) Metasploit
C) FOCA
D) Wireshark
Answer: C
Rationale: FOCA (Fingerprinting Organizations with Collected Archives) is a tool designed specifically to find and
analyze metadata in documents (like PDFs, Word docs) to discover usernames, software versions, and network
paths.
4. What is the purpose of the `whois` command?
A) To determine the geographic location of an IP address.
B) To query databases that store registered users or assignees of an Internet resource.
C) To scan a network for open ports.
D) To intercept and analyze network traffic.
Answer: B
, Rationale: `whois` is used to query domain name registrars and regional internet registries to find information
about the owner of a domain name or IP address block, such as contact information and name servers.
5. You are using `theHarvester` and want to find email addresses associated with a target domain. Which of the
following is a valid data source for this tool?
A) Metasploit
B) Google
C) Nmap
D) John the Ripper
Answer: B
Rationale: `theHarvester` gathers emails, subdomains, hosts, employee names, open ports, and banners from
different public sources like search engines (Google, Bing), PGP key servers, and Shodan.
6. In the context of a penetration test, what is "scope creep"?
A) The gradual expansion of the test's goals beyond the original agreement.
B) A technique for scanning a large network range.
C) The process of escalating privileges on a compromised host.
D) A type of vulnerability in web applications.
