I85PREP
⌘ K
PJPT study materials
PJPT study resources

PJPT practice questions

One question at a time. Build your PJPT understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Reconnaissance and Information Gathering

During a penetration test, you run `whois example.com`. Which piece of information is most directly useful for mapping the target's external attack surface?

  1. The HTTP server banner
  2. The operating system version of the web server
  3. The list of open TCP ports
  4. The registrant's name server records Correct answer.

Explanation

WHOIS records expose registration details including authoritative name servers, which reveal DNS infrastructure and potential zone-transfer or subdomain enumeration paths. They do not report live service banners, OS versions, or port states, so those must come from active scanning.

Question 2Reconnaissance and Information Gathering

You want to discover subdomains of target.com without sending DNS queries directly from your own resolver. Which technique best fits this requirement?

  1. Brute-forcing common names with a local wordlist
  2. Performing a zone transfer against the authoritative server
  3. Querying certificate transparency logs Correct answer.
  4. Running a reverse DNS sweep of the target's IP range

Explanation

Certificate transparency logs are public repositories of issued TLS certificates and can be queried through third-party services, so the target's DNS servers never see your lookups. Brute force, reverse sweeps, and zone transfers all generate traffic that can be attributed to your infrastructure.

Question 3Reconnaissance and Information Gathering

An Nmap scan returns `25/tcp open smtp` and `443/tcp open https`. Which reconnaissance conclusion is best supported by these results alone?

  1. The host exposes both a mail transfer service and a web service Correct answer.
  2. The host is running a Linux kernel version 5.x
  3. The host is behind a web application firewall
  4. The host is vulnerable to SMTP relay abuse

Explanation

Open port results only confirm that a service is listening on each port; they do not identify the OS, prove vulnerabilities, or detect a WAF. Further banner grabbing and version detection are required before drawing those conclusions.

Question 4Reconnaissance and Information Gathering

Which DNS record type should you query to learn which mail servers accept email for a target domain?

  1. TXT
  2. A
  3. CNAME
  4. MX Correct answer.

Explanation

MX records map a domain to its mail exchanger hosts and include preference values. A records map names to IPv4 addresses, CNAME records create aliases, and TXT records carry arbitrary text such as SPF or verification strings.

Question 5Reconnaissance and Information Gathering

During passive reconnaissance you find a JavaScript file on the target's site that contains the string `api.internal.target.com`. What is the most appropriate next step?

  1. Report the finding as a critical vulnerability without further testing
  2. Immediately launch a brute-force attack against the hostname
  3. Ignore it because internal hostnames are out of scope by definition
  4. Add the hostname to your scope notes and resolve it to identify reachable internal services Correct answer.

Explanation

Hardcoded internal hostnames are valuable reconnaissance artifacts that may resolve to reachable services or reveal architecture. Documenting and resolving them is a low-impact next step before any active testing, and scope must be confirmed rather than assumed.

Question 6Reconnaissance and Information Gathering

You run `dig axfr target.com @ns1.target.com` and receive a full list of records. What does this indicate?

  1. The name server is vulnerable to cache poisoning
  2. The zone transfer was refused by the server
  3. The domain uses DNSSEC validation
  4. The name server permits unauthenticated zone transfers Correct answer.

Explanation

A successful AXFR response means the authoritative server allowed the zone to be transferred to your client without authentication, exposing all records. This is a misconfiguration that reveals internal hostnames and network structure.

Question 7Reconnaissance and Information Gathering

Which tool is designed specifically to query public sources for information about a domain without sending traffic to the target's own infrastructure?

  1. theHarvester Correct answer.
  2. Hydra
  3. Nmap
  4. Nikto

Explanation

theHarvester aggregates emails, hostnames, and employee names from public sources such as search engines and certificate logs. Nmap and Nikto actively probe the target, and Hydra performs online password attacks.

Question 8Reconnaissance and Information Gathering

A web server responds to a request for a nonexistent page with a generic 200 OK page. Which reconnaissance implication is most accurate?

  1. The server is using HTTP/2
  2. Content discovery tools may report false positives unless they compare response bodies or sizes Correct answer.
  3. The server is immune to directory brute forcing
  4. The server is definitely running Apache

Explanation

When every path returns 200, status codes alone cannot distinguish real resources from the catch-all page. Tools must compare response length, hash, or content to filter false positives.

Question 9Reconnaissance and Information Gathering

Which Google dork operator restricts results to a specific site and file type?

  1. link:example.com format:pdf
  2. site:example.com filetype:pdf Correct answer.
  3. intitle:example.com type:doc
  4. inurl:example.com ext:html

Explanation

The `site:` operator limits results to a domain, and `filetype:` filters by file extension, so the combination returns PDFs hosted on example.com. The other operators either do not exist or do not perform the same filtering.

Question 10Reconnaissance and Information Gathering

You want to enumerate valid usernames on an SMTP server without locking accounts. Which technique is most appropriate?

  1. Brute-forcing the SMTP AUTH mechanism
  2. Sending a VRFY command for each candidate and observing the response Correct answer.
  3. Running a dictionary attack against the login prompt
  4. Sending a RCPT TO command for each candidate and observing the response code

Explanation

The SMTP VRFY command asks the server to verify a mailbox and often returns distinct responses for valid and invalid users. RCPT TO can also reveal validity during a transaction, but VRFY is the direct verification command and is typically less disruptive than authentication attacks.

Question 11Reconnaissance and Information Gathering

Which data source is most useful for discovering employee names and email address formats at a target organization?

  1. TCP sequence numbers
  2. Reverse DNS records
  3. TLS certificate serial numbers
  4. Public professional networking profiles Correct answer.

Explanation

Professional networking sites list employees, job titles, and sometimes email formats, making them a primary OSINT source for people-focused reconnaissance. DNS, certificates, and TCP headers do not expose personal identity information.

Question 12Reconnaissance and Information Gathering

During reconnaissance you find a hostname `dev.target.com` that resolves to a private RFC 1918 address. What is the most reasonable interpretation?

  1. The DNS server is compromised
  2. The target has exposed an internal development system to the internet
  3. The hostname is a decoy and should be ignored
  4. The DNS record may point to an internal-only system and is not directly reachable from your external position Correct answer.

Explanation

A public DNS record can legitimately point to a private address, often indicating split-horizon DNS or internal naming leakage. From an external vantage point the address is not routable, so it cannot be tested directly without an internal foothold.

Question 13Reconnaissance and Information Gathering

Which Nmap scan type completes a TCP three-way handshake with the target port?

  1. TCP SYN scan
  2. UDP scan
  3. TCP connect scan Correct answer.
  4. FIN scan

Explanation

A TCP connect scan uses the operating system's connect() call, which completes the full handshake. A SYN scan sends a SYN and resets the connection before the handshake finishes, while UDP and FIN scans use different protocols or flag combinations.

Question 14Reconnaissance and Information Gathering

You are performing external reconnaissance and want to avoid alerting the target's intrusion detection system. Which approach best reduces detection risk?

  1. Using a single-threaded full-connect scan
  2. Increasing scan speed to finish before detection
  3. Spacing out requests and using passive sources first Correct answer.
  4. Scanning from the target's own network range

Explanation

Passive sources generate no target traffic, and slow, spaced requests are less likely to trigger rate-based or signature-based detection. Faster scans and full-connect scans create more logs and anomalous patterns.

Question 15Reconnaissance and Information Gathering

A WHOIS lookup for a target IP address returns a netblock registered to a cloud provider. What does this most likely indicate?

  1. The target owns the entire cloud provider's network
  2. The target is using a content delivery network
  3. The IP address is a private address
  4. The target's infrastructure is hosted in a public cloud environment Correct answer.

Explanation

WHOIS for an IP address returns the allocation and organization that owns the netblock. A cloud provider's name in that record indicates the host is in that provider's address space, which is common for cloud-hosted services.

Question 16Reconnaissance and Information Gathering

Which technique uses search engine caches and archived snapshots to view historical versions of a target's website?

  1. Port scanning
  2. Zone walking
  3. Banner grabbing
  4. Wayback Machine enumeration Correct answer.

Explanation

The Wayback Machine archives historical web pages, which can reveal old endpoints, comments, and credentials that have since been removed. Port scanning and banner grabbing are active techniques, and zone walking targets DNSSEC NSEC records.

Question 17Reconnaissance and Information Gathering

You are analyzing an SPF TXT record that ends with `-all`. What does this indicate?

  1. The record is a DKIM public key
  2. Mail from unlisted senders should be marked as soft fail
  3. Mail from unlisted senders should be rejected Correct answer.
  4. The domain does not use SPF

Explanation

The `-all` qualifier is a hard fail, instructing receivers to reject messages from senders not listed in the SPF record. `~all` is a soft fail, and the record type is TXT, not DKIM.

Question 18Reconnaissance and Information Gathering

Which tool is commonly used to perform DNS enumeration and can attempt zone transfers?

  1. dnsrecon Correct answer.
  2. Burp Suite
  3. Wireshark
  4. Metasploit

Explanation

dnsrecon is a dedicated DNS enumeration tool that supports standard queries, zone transfer attempts, and brute forcing. Wireshark captures traffic, Metasploit is an exploitation framework, and Burp Suite focuses on web application testing.

Question 19Reconnaissance and Information Gathering

During reconnaissance you discover a web application with a `/backup/` directory that returns a directory listing. What is the most appropriate action?

  1. Immediately download all files and publish them
  2. Delete the directory to secure it
  3. Note the finding and review the listing for sensitive files such as configuration or database dumps Correct answer.
  4. Ignore it because directory listings are not security issues

Explanation

Directory listings can expose backup archives, configuration files, or source code that may contain credentials or reveal application structure. Documenting and reviewing the contents within scope is the appropriate reconnaissance step.

Question 20Reconnaissance and Information Gathering

Which HTTP response header can reveal the web server software and version?

  1. Content-Type
  2. Server Correct answer.
  3. Accept-Encoding
  4. Set-Cookie

Explanation

The Server response header often contains the product name and version, such as Apache/2.4.41. Content-Type describes the body format, Accept-Encoding is a request header, and Set-Cookie carries session data.

Question 21Reconnaissance and Information Gathering

You want to identify virtual hosts hosted on a single IP address. Which technique is most direct?

  1. Performing a traceroute to the IP address
  2. Querying the PTR record for the IP address
  3. Sending requests with different Host headers and comparing responses Correct answer.
  4. Running a UDP scan of the IP address

Explanation

Virtual host discovery relies on the Host header: different values can return different sites from the same IP. UDP scans, PTR lookups, and traceroute do not reveal name-based virtual hosting.

Question 22Reconnaissance and Information Gathering

An organization's DNS server returns NXDOMAIN for random subdomains but resolves known internal names when queried with a specific source IP. What does this suggest?

  1. The server is vulnerable to cache poisoning
  2. The DNS server is offline
  3. The domain has no DNS records
  4. The organization uses split-horizon DNS with access controls Correct answer.

Explanation

Split-horizon DNS serves different answers depending on the source, often exposing internal names only to internal clients. External queries receive NXDOMAIN, which is why the names do not resolve from your position.

Question 23Reconnaissance and Information Gathering

Which of the following best describes passive reconnaissance?

  1. Scanning the target's network for open ports
  2. Exploiting a vulnerability to gain access
  3. Sending crafted packets to elicit responses from the target
  4. Collecting information from public sources without interacting with the target Correct answer.

Explanation

Passive reconnaissance gathers information from third-party and public sources without sending traffic to the target, reducing detection risk. Active techniques such as scanning and exploitation interact directly with the target.

Question 24Reconnaissance and Information Gathering

You find a GitHub repository belonging to the target that contains hardcoded AWS access keys. What is the most appropriate next step?

  1. Post the keys publicly to pressure the target
  2. Ignore it because it is outside the network scope
  3. Document the finding and report it to the client through the agreed channel Correct answer.
  4. Use the keys to access the target's cloud environment

Explanation

Exposed credentials are a serious finding that should be reported through the engagement's communication channel so the client can rotate them. Using the keys without authorization may exceed scope and cause harm.

Question 25Reconnaissance and Information Gathering

Which Nmap option enables version detection of services on open ports?

  1. -sV Correct answer.
  2. -sS
  3. -Pn
  4. -O

Explanation

The `-sV` option probes open ports to determine service and version information. `-sS` performs a SYN scan, `-O` enables OS detection, and `-Pn` skips host discovery.

Question 26Reconnaissance and Information Gathering

A client asks you to assess a domain and gives you only its name. You want to discover related domains and hostnames that share the same registrant email or organization name without sending any packets to the client. Which approach best fits this goal?

  1. Run a full TCP SYN scan of the /16 netblock that contains the domain's A record
  2. Query a reverse-WHOIS service for the registrant email and pivot to domains registered with the same contact Correct answer.
  3. Send a zone transfer request to every authoritative nameserver for the domain
  4. Brute-force subdomains with a large wordlist against the authoritative nameserver

Explanation

Reverse WHOIS is a passive technique that maps a registrant contact such as an email or organization to other domains registered with the same data, which exposes related infrastructure without touching the target. Scans and zone-transfer requests generate traffic toward the target and fall outside passive collection.

Question 27Reconnaissance and Information Gathering

During external reconnaissance you query a certificate transparency log for a target's domain. Which finding is most directly obtainable from that data?

  1. Subdomains and hostnames that appeared in issued TLS certificates Correct answer.
  2. The plaintext credentials used to log in to the web application
  3. The internal IP addresses behind the organization's NAT gateway
  4. The exact patch level of the web server software

Explanation

Certificate transparency logs are public records of issued certificates, and each entry contains the subject alternative names, which frequently reveal internal-sounding or forgotten subdomains. They contain no traffic, credentials, or server version data.

Question 28Reconnaissance and Information Gathering

You are mapping a target's external attack surface and notice that `mail.target.com` and `vpn.target.com` resolve to the same public IP, but the main site `www.target.com` resolves to a different address. Which reconnaissance conclusion is best supported by this observation?

  1. The different IP for www proves the organization uses no load balancing anywhere
  2. The two shared hosts are certainly the same physical server and can be treated as one asset
  3. The shared IP likely fronts multiple services and warrants virtual-host enumeration on that address Correct answer.
  4. The shared IP indicates that mail and VPN are hosted on an internal-only network

Explanation

A single public address serving multiple hostnames usually means name-based virtual hosting or a reverse proxy, so enumerating virtual hosts and services on that IP is the productive next step. The observation alone cannot prove shared hardware, absence of load balancing, or internal-only hosting.

Question 29Reconnaissance and Information Gathering

While reviewing a target's DNS records you find a TXT record containing `v=DMARC1; p=none; rua=mailto:[email protected]`. What does this configuration most directly reveal to you as a tester?

  1. The domain rejects all mail from unauthorized senders and will quarantine failures
  2. The domain's SPF record is invalid and will always fail alignment checks
  3. The domain publishes a reporting address but instructs receivers to take no action on failures Correct answer.
  4. The domain has no DMARC policy and the record will be ignored by receivers

Explanation

The `p=none` tag is the DMARC policy, and it tells receiving mail systems to monitor and report but not to quarantine or reject failing messages. The `rua` tag only supplies an aggregate report destination. This makes spoofing easier to attempt and gives the tester a useful signal about mail controls.

Question 30Scanning and Enumeration

During a PJPT engagement you want a fast TCP connect scan that does not require raw socket privileges. Which Nmap scan type should you select?

  1. -sU
  2. -sA
  3. -sS
  4. -sT Correct answer.

Explanation

The TCP connect scan (-sT) completes the full three-way handshake using the operating system's connect() call, so it works without root or raw socket privileges. It is slower and noisier than a SYN scan but reliable when privileges are limited.

Question 31Scanning and Enumeration

A host returns RST for every probed TCP port during a SYN scan. What does this most strongly indicate?

  1. The target is behind a proxy that rewrites packets
  2. The host is up and the ports are closed Correct answer.
  3. A stateful firewall is silently dropping probes
  4. The port list was filtered by the scanner

Explanation

A TCP RST in response to a SYN means the host received the probe and no service is listening, so the port is closed. Because replies arrive, the host is confirmed reachable and not silently dropped by a filtering device.

Question 32Scanning and Enumeration

You need to enumerate SMB shares, users, and OS information on a Windows host without credentials. Which tool is purpose-built for this?

  1. sqlmap
  2. nikto
  3. hydra
  4. enum4linux-ng Correct answer.

Explanation

enum4linux-ng wraps Samba utilities to enumerate SMB shares, users, groups, and OS details, including null-session and guest access. It is designed specifically for Windows/SMB reconnaissance without credentials.

Question 33Scanning and Enumeration

Which Nmap NSE script category should you invoke to run scripts that actively attempt to exploit a discovered vulnerability?

  1. version
  2. discovery
  3. exploit Correct answer.
  4. safe

Explanation

The exploit category contains scripts that actively attempt to take advantage of vulnerabilities and can crash or alter the target. The safe, discovery, and version categories perform non-destructive probing or identification.

Question 34Scanning and Enumeration

During enumeration you observe that a DNS server answers zone transfer requests from any host. What is the primary security impact?

  1. Clients will receive forged DNSSEC signatures
  2. The server will fail to resolve external domains
  3. The zone file becomes read-only for administrators
  4. An attacker can harvest all hostnames and IP mappings in the zone Correct answer.

Explanation

An unrestricted AXFR transfer reveals the entire contents of a DNS zone, exposing internal hostnames, subdomains, and IP addresses useful for mapping the attack surface. It does not break resolution or DNSSEC by itself.

Question 35Scanning and Enumeration

Which command performs a UDP scan of the top 50 ports while also running service version detection?

  1. nmap -sU -p- target
  2. nmap -sU --top-ports 50 -sV target Correct answer.
  3. nmap -sn --top-ports 50 target
  4. nmap -sT --top-ports 50 -sV target

Explanation

The -sU flag selects UDP scanning, --top-ports 50 limits the scan to the 50 most common ports, and -sV enables version detection. Combining them yields a focused UDP scan with service fingerprinting.

Question 36Scanning and Enumeration

An HTTP service responds to a request for a nonexistent path with a 200 status and a generic page. Which enumeration technique best distinguishes real directories from this catch-all behavior?

  1. Switch from GET to HEAD requests only
  2. Compare response body length and hash against a known-invalid baseline path Correct answer.
  3. Increase the request timeout
  4. Rely solely on the HTTP status code

Explanation

When a server returns 200 for everything, status codes become unreliable, so comparing response size, hash, or content against a baseline request for a random nonexistent path reveals true hits. This filters out soft-404 catch-all pages.

Question 37Scanning and Enumeration

Which SMB protocol detail most directly enables null-session enumeration on a misconfigured legacy server?

  1. The server requires NTLMv2 with extended session security
  2. Anonymous logon is permitted and share-level permissions allow listing Correct answer.
  3. The server disables the IPC$ share
  4. SMB signing is enforced on all connections

Explanation

Null sessions succeed when the server accepts anonymous logon and exposes shares such as IPC$ for listing. Enforcing signing, requiring NTLMv2, or removing IPC$ closes these paths.

Question 38Scanning and Enumeration

Which tool is designed to brute-force virtual host names on a web server by comparing responses to a default host?

  1. ike-scan
  2. onesixtyone
  3. ffuf Correct answer.
  4. nbtscan

Explanation

ffuf supports vhost discovery mode (the -H Host: FUZZ technique) and filters responses against a baseline to reveal virtual hosts. nbtscan, onesixtyone, and ike-scan target NetBIOS, SNMP, and IKE respectively.

Question 39Scanning and Enumeration

A UDP scan reports a port as 'open|filtered'. What is the correct interpretation?

  1. The port is definitely open and running a service
  2. The host is down and cannot be reached
  3. The port is definitely closed and unreachable
  4. No response was received, so the port may be open or blocked by filtering Correct answer.

Explanation

UDP services often do not reply to empty probes, and firewalls may drop them silently, so absence of a response is ambiguous. Nmap labels such ports open|filtered until a service-specific probe elicits a reply.

Question 40Scanning and Enumeration

Which Nmap option enables OS fingerprinting and requires elevated privileges?

  1. -A
  2. -O Correct answer.
  3. -sV
  4. -Pn

Explanation

The -O option activates OS detection by analyzing TCP/IP stack behaviors and requires raw socket privileges. The -sV flag fingerprints services, -A bundles several features, and -Pn skips host discovery.

Question 41Scanning and Enumeration

You want to identify live hosts on a subnet using ICMP echo, TCP SYN to port 443, and ARP where applicable. Which Nmap flag set accomplishes this host discovery?

  1. -sS -sV -O
  2. -p 443 --open
  3. -sn -sU
  4. -PE -PS443 -PR Correct answer.

Explanation

The -PE, -PS443, and -PR flags enable ICMP echo, TCP SYN to port 443, and ARP ping respectively, combining multiple discovery techniques. This improves reliability across hosts that block individual probe types.

Question 42Scanning and Enumeration

Which SNMP enumeration step is most likely to reveal device details such as sysDescr and interface information?

  1. Scanning UDP port 162 for traps
  2. Running an SNMP set request on OID 1.3.6.1.2.1.1
  3. Querying the public community string with snmpwalk Correct answer.
  4. Sending an SNMP trap to the manager

Explanation

A valid read-only community string such as public allows an snmpwalk to traverse the MIB and retrieve system description, interfaces, and other device details. Traps and set requests do not provide read enumeration of the MIB.

Question 43Scanning and Enumeration

Which technique best enumerates user accounts on an Active Directory domain controller over LDAP when credentials are already available?

  1. Running an SNMP walk on the DC
  2. Querying the directory with ldapsearch using a bind account Correct answer.
  3. Performing an SMB null session
  4. Scanning UDP 137 for NetBIOS

Explanation

With valid credentials, an LDAP bind allows ldapsearch to query directory objects such as users, groups, and computers directly. SMB null sessions, SNMP, and NetBIOS are not the primary path for structured AD enumeration.

Question 44Scanning and Enumeration

During a scan you receive an ICMP type 3 code 13 message from a router. What does this signify?

  1. The target port is open and accepting connections
  2. The administrator filtered the probe with a communication-prohibited rule Correct answer.
  3. The probe was rate-limited by the target
  4. The host is unreachable due to a routing loop

Explanation

ICMP type 3 code 13 is 'communication administratively prohibited', indicating a filtering device rejected the packet by policy. Nmap interprets this as a filtered state rather than open or closed.

Question 45Scanning and Enumeration

Which Nmap timing template is the most aggressive and increases the risk of missing results or overwhelming the target?

  1. -T3
  2. -T5 Correct answer.
  3. -T2
  4. -T0

Explanation

The -T5 template, also called insane, sends probes with minimal delay and short timeouts, maximizing speed at the cost of accuracy and target stability. Lower templates are progressively slower and gentler.

Question 46Scanning and Enumeration

A web server returns different response lengths for /admin when authenticated versus unauthenticated. Which enumeration approach best leverages this observation?

  1. Send only HEAD requests to the path
  2. Scan the path with a UDP probe
  3. Request the path with and without session cookies and compare responses Correct answer.
  4. Disable redirects and ignore the body

Explanation

Comparing responses with and without valid session cookies reveals access-controlled content that behaves differently for authenticated users. This differential analysis exposes hidden functionality that a single unauthenticated request would miss.

Question 47Scanning and Enumeration

Which tool scans a network for NetBIOS name information and reports hostnames, users, and MAC addresses?

  1. enum4linux-ng
  2. nbtscan Correct answer.
  3. crackmapexec
  4. smbclient

Explanation

nbtscan queries NetBIOS name service on UDP 137 and reports NetBIOS names, logged-on users, and MAC addresses for hosts. The other tools focus on SMB sessions, share access, or credential spraying rather than bulk NetBIOS name enumeration.

Question 48Scanning and Enumeration

An Nmap service scan returns a banner for port 22 but the version string looks generic. Which additional step best improves service identification?

  1. Rescan the port with -sU
  2. Disable host discovery with -Pn
  3. Increase the -T timing template
  4. Run NSE version and banner scripts against the port Correct answer.

Explanation

NSE scripts in the version and banner categories send protocol-specific probes that often reveal more detail than the default version detection. They can distinguish services that share a port or present ambiguous banners.

Question 49Scanning and Enumeration

Which flag causes Nmap to continue scanning even when ping probes indicate the host is down?

  1. -Pn Correct answer.
  2. -PS
  3. -sn
  4. -PE

Explanation

The -Pn option skips host discovery and treats every target as online, forcing port scans even when ICMP or other probes fail. This is useful when firewalls block discovery traffic.

Question 50Scanning and Enumeration

You discover an open TCP 3306 port. Which enumeration action is most appropriate to confirm the service and its version without credentials?

  1. Run a UDP SNMP walk against the port
  2. Send a MySQL handshake and read the server greeting banner Correct answer.
  3. Attempt an SMB null session
  4. Issue an HTTP GET request to the port

Explanation

MySQL sends a greeting packet containing the server version immediately after connection, so reading the handshake banner confirms the service and version. This requires no credentials and is the standard unauthenticated fingerprint step.