A penetration tester is conducting reconnaissance for an upcoming assessment of a large corporate client. The client authorized spear phishing in the rules of engagement. Which of the following…

The correct answer is C. Social media. When developing a phishing campaign, the tester should first use social media to gather information about the targets. Purpose: Social media platforms like LinkedIn, Facebook, and Twitter provide valuable information about individuals, including their job roles, contact…

Submitted by obi.ng· Mar 6, 2026Reconnaissance and Enumeration

Question

A penetration tester is conducting reconnaissance for an upcoming assessment of a large corporate client. The client authorized spear phishing in the rules of engagement. Which of the following should the tester do first when developing the phishing campaign?

Options

AShoulder surfing
BRecon-ng
CSocial media
DPassword dumps

How the community answered

(36 responses)

B
3% (1)
C
94% (34)
D
3% (1)

Explanation

When developing a phishing campaign, the tester should first use social media to gather information about the targets. Purpose: Social media platforms like LinkedIn, Facebook, and Twitter provide valuable information about individuals, including their job roles, contact details, interests, and connections. Reconnaissance: This information helps craft convincing and targeted phishing emails, increasing the likelihood of success. Gathering Information: Collect details about the target employees, such as their names, job titles, email addresses, and any personal information that can make the phishing email more credible. Crafting Phishing Emails: Use the gathered information to personalize phishing emails, making them appear legitimate and relevant to the recipients.

Topics

#social engineering#spear phishing#open-source intelligence#reconnaissance

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice