Why might an tester review open job postings for a target organization?

• A. To identify legal constraints
• B. To learn about the infrastructure used
• C. To get source code
• D. To find the CEO's contact

Answer: (B)

Reviewing open job postings is about gathering publicly available information to infer the target’s technology stack and deployment practices. Job ads often list the platforms and tools teams use—cloud providers (AWS, Azure, GCP), container platforms (Kubernetes, Docker), configuration and provisioning tools (Terraform, Ansible), CI/CD pipelines (Jenkins, GitLab CI), and security tooling (SIEMs, vulnerability scanners). They may also mention languages, databases, and middleware. This helps the tester build an internal map of the organization’s infrastructure, focusing reconnaissance and validation on likely technologies and configurations, which improves the accuracy of an engagement’s attack surface assessment.

Other options don’t fit as well because legal constraints are not typically described in job postings, source code isn’t exposed through listings, and CEO contact information isn’t the purpose of this OSINT activity.