SIMULATION A penetration tester is performing reconnaissance for a web application assessment. Upon investigation, the tester reviews the robots.txt file for items of interest. INSTRUCTIONS Select…

Submitted by devops_kid· Mar 6, 2026CompTIA PenTest+ Domain 2: Information Gathering and Vulnerability Scanning - specifically passive and active reconnaissance techniques against web applications, including open-source intelligence (OSINT) gathering and tool selection for targeted assessments.

Question

SIMULATION A penetration tester is performing reconnaissance for a web application assessment. Upon investigation, the tester reviews the robots.txt file for items of interest. INSTRUCTIONS Select the tool the penetration tester should use for further investigation. Select the two entries in the robots.txt file that the penetration tester should recommend for removal. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button. Answer:

Exhibits

Explanation

WPScan is the correct tool because the presence of '/wp-login.php' in the robots.txt file reveals the site is running WordPress, making WPScan - a dedicated WordPress vulnerability scanner - the most appropriate tool for further reconnaissance. The entries '/admin' and '/wp-login.php' should be recommended for removal because listing them in robots.txt, even as 'Disallow', actually advertises sensitive administrative paths to attackers (robots.txt is publicly readable), making it easier to target login portals and admin interfaces. Removing these entries reduces the attack surface by not explicitly disclosing the existence and location of privileged access points.

Topics

#Web Application Reconnaissance#robots.txt Analysis#WordPress Security#Penetration Testing Tools

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice