Which of the following Penetration Testing steps includes network mapping and OS fingerprinting?

Gather information (reconnaissance) is the phase where testers actively profile the target by performing network mapping to discover live hosts and network topology, and OS fingerprinting to identify the operating systems running on those hosts. These techniques build a detailed technical picture of the target environment and are foundational inputs for later phases such as vulnerability identification and exploitation.

Exploit is the phase where confirmed vulnerabilities are actively leveraged to gain unauthorized access, not where passive or active discovery techniques such as mapping and fingerprinting occur.

Verify vulnerabilities involves scanning and confirming the presence of specific known weaknesses on discovered systems, which is a narrower activity that occurs after initial reconnaissance.

The planning stage defines scope, rules of engagement, and legal authorization before any technical activity begins, so no active scanning or fingerprinting takes place here.