mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester has been given access to a…
A penetration tester has been given access to a network tap on a client's internal network. The tester wants to perform initial reconnaissance by identifying all live hosts and their operating systems without sending any packets that could be detected. Which technique is most appropriate?
⚠ Common exam trap
Candidates often assume passive techniques like packet capture cannot identify operating systems, or they mistakenly think that ARP scans and ping sweeps are 'quiet' because they use low-level protocols, forgetting that any packet injection is detectable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run Wireshark to capture traffic and analyze source IP addresses and TCP/IP stack signatures.
Capturing traffic with Wireshark from a network tap is entirely passive—it never injects packets into the network. By analyzing source IP addresses and TCP/IP stack signatures (e.g., TTL values, window sizes, and IP ID patterns), the tester can identify live hosts and infer their operating systems without sending any detectable traffic. This aligns perfectly with the requirement to avoid sending any packets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perform an ARP scan using arp-scan from a connected workstation.
Why it's wrong here
ARP scanning with arp-scan actively sends crafted ARP requests to every IP in the local subnet, causing target hosts to respond and fill their ARP caches. This burst of link-layer broadcast traffic is easily detected by network security monitoring tools, and because it uses raw sockets it can also trigger host-based intrusion detection. Moreover, ARP only works within the local broadcast domain, so it cannot enumerate remote subnets and leaves forensic evidence of the probe. Thus, it is an active, detectable technique that violates the requirement for passive reconnaissance.
- ✓
Run Wireshark to capture traffic and analyze source IP addresses and TCP/IP stack signatures.
Why this is correct
Wireshark placed on a network tap in promiscuous mode simply observes frames already flowing across the wire, injecting zero packets and therefore remaining invisible to detection mechanisms. By examining source IP addresses in captured traffic, the tester builds a list of live hosts that are actively communicating. Passive TCP/IP stack fingerprinting then infers the OS of each host by analyzing fields such as initial TTL, TCP window size, DF flag, and option ordering, without generating any traffic. This fully satisfies the goal of stealthy network discovery.
- ✗
Use Nmap with the -sn flag to perform a ping sweep of the subnet.
Why it's wrong here
Nmap's -sn flag (ping sweep) is an active enumeration method that sends ICMP echo requests, TCP SYN packets to common ports, or ARP probes when run on the same LAN, depending on the context. These probe packets traverse the network and are observable by firewalls, IDS/IPS, and endpoint agents, potentially triggering alerts. Even though -sn omits port scanning, it still generates significant out-of-band traffic and does not provide OS identification, only host availability. Therefore it is not a passive reconnaissance approach.
- ✗
Initiate a DNS zone transfer request to the internal DNS servers.
Why it's wrong here
A DNS zone transfer (AXFR) is an active query that instructs a nameserver to send its entire zone database, including all hostnames and associated IP addresses, which can be a high-value disclosure. However, most properly configured DNS servers restrict AXFR to authorized secondaries, and the attempt itself is logged and can be flagged as a security violation. Additionally, this technique only reveals DNS records, which may be incomplete or outdated, and it provides no information about the operating systems of active hosts. As an active, non-stealthy operation, it is inappropriate for this task.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.