Information Gathering & Vulnerability Scanning
46 practice questions with explanations — 15 free to try
PassNova has 46 CompTIA PenTest+ practice questions on Information Gathering & Vulnerability Scanning, each with a clear explanation. A 15-question taster is free with no sign-up; the full bank is part of PassNova Premium. Updated for 2026.
Information Gathering & Vulnerability Scanning: example questions & answers
3 worked examples with answers and explanations below. Try 15 CompTIA PenTest+ questions free in the browser; the full 46-question Information Gathering & Vulnerability Scanning bank is part of PassNova Premium.
Which Nmap option performs a TCP SYN (half-open) scan?
- A-sn
- B-sV
- C-sS✓
- D-sU
Answer: The -sS flag triggers a SYN scan, which sends SYN packets and analyses responses without completing the TCP handshake, making it fast and relatively stealthy.
A tester wants to identify the service versions running on open ports during an Nmap scan. Which flag should be used?
- A-sn
- B-Pn
- C-sV✓
- D-F
Answer: The -sV flag enables service and version detection, probing open ports to determine the application and version listening, which aids vulnerability mapping.
Which technique gathers information about a target using only publicly available sources without sending packets directly to the target's systems?
- AExploitation that actively attacks a discovered weakness
- BPrivilege escalation, which raises access on a host already reached
- CActive scanning, which sends probes directly to the target
- DPassive reconnaissance (OSINT)✓
Answer: Passive reconnaissance, or open-source intelligence (OSINT), collects data from public sources such as search engines, WHOIS, and social media without interacting with the target directly, leaving no footprint on its systems.