Which phase of penetration testing involves gathering information about the target?

The correct answer is B. Reconnaissance. Reconnaissance is the information-gathering phase of a penetration test, where testers collect data about the target - such as IP ranges, open ports, employee names, technologies in use, and potential entry points - before any active attack begins. A (Exploitation) is wrong becau

Information Gathering and Vulnerability Analysis

Question

Options

AExploitation
BReconnaissance
CReporting
DPost-exploitation

How the community answered

(37 responses)

A
3% (1)
B
89% (33)
C
5% (2)
D
3% (1)

Explanation

Reconnaissance is the information-gathering phase of a penetration test, where testers collect data about the target - such as IP ranges, open ports, employee names, technologies in use, and potential entry points - before any active attack begins.

A (Exploitation) is wrong because this phase involves actively leveraging discovered vulnerabilities to gain access, not gathering information.
C (Reporting) is wrong because this is the final phase where findings are documented and communicated to stakeholders.
D (Post-exploitation) is wrong because this phase occurs after a system has already been compromised, focusing on lateral movement, persistence, and data exfiltration.

Memory tip: Think of "Reconnaissance" like a military scout - you recon before you attack. The word itself means "to survey or explore," making it the natural fit for the information-gathering phase.

Topics

#Reconnaissance#Penetration Testing Phases#Information Gathering#PTES

Community Discussion

No community discussion yet for this question.

Full 112-52 Practice