A penetration tester has compromised a Windows domain-joined workstation and needs to identify all domain controllers and their IP addresses without triggering detection mechanisms. Which technique is most likely to avoid raising alerts?

Attempt a DNS zone transfer from the internal DNS server

Zone transfers are typically restricted to authorized only servers and are often logged and monitored, increasing detection risk.

Perform an ARP scan of the subnet to identify active IP addresses

ARP scanning is an active technique that can be detected by network intrusion detection systems and is more noisy.

Use Nmap to perform a SYN scan of the entire subnet looking for Kerberos service ports

SYN scanning is an active network scan that is highly detectable and likely to trigger alerts on security devices.

What does this PT0-002 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Perform an LDAP query using ADSI to enumerate domain controllers — LDAP queries to Active Directory are normal domain operations performed by many applications and services. Using ADSI (Active Directory Service Interfaces) from a domain-joined machine to query for domain controllers is a standard activity and is less likely to be flagged as malicious compared to active scans. DNS zone transfer is often restricted and monitored. ARP scans and SYN scans are active reconnaissance techniques that are more likely to be detected by network security monitoring tools.

What should I do if I get this PT0-002 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.