In a penetration test, which phase focuses on gathering information about the target network or device?

In a penetration test, which phase focuses on gathering information about the target network or device?

• A. Exploitation
• B. Discovery
• C. Post-Exploitation
• D. Lateral Movement

Answer: (B)

Gathering information about the target network or device is the reconnaissance phase, often called discovery. In this stage, testers map out what exists on the target, identify hosts, services, open ports, operating systems, and potential entry points. They use both passive methods (like OSINT and observing leaked data) and active methods (scanning and enumeration) to build a picture of the environment before attempting any access. This information sets the direction for later testing steps. The other phases serve different purposes: exploitation is about taking advantage of vulnerabilities to gain access; post-exploitation focuses on what you can do after you’ve breached the system; and lateral movement involves moving through the network to reach additional assets.

Gathering information about the target network or device is the reconnaissance phase, often called discovery. In this stage, testers map out what exists on the target, identify hosts, services, open ports, operating systems, and potential entry points. They use both passive methods (like OSINT and observing leaked data) and active methods (scanning and enumeration) to build a picture of the environment before attempting any access. This information sets the direction for later testing steps.

The other phases serve different purposes: exploitation is about taking advantage of vulnerabilities to gain access; post-exploitation focuses on what you can do after you’ve breached the system; and lateral movement involves moving through the network to reach additional assets.