PT0-002 Reconnaissance and Enumeration Practice Question
A penetration tester is conducting a web application assessment and discovers that the target uses WordPress. The tester wants to identify installed plugins, themes, and potential vulnerabilities. Which of the following tools is best suited for this task?
⚠ Common exam trap
Test-takers frequently confuse Nikto's general web scanning with CMS-specific enumeration, but Nikto cannot identify WordPress plugins or themes without custom rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
WPScan
WPScan is a dedicated WordPress security scanner that enumerates installed plugins, themes, and known vulnerabilities by querying the WordPress API and fingerprinting version-specific files. It is purpose-built for WordPress assessments, making it the best choice for this task.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
WPScan
Why this is correct
WPScan is purpose-built for WordPress security assessments: it queries the WPScan vulnerability database, enumerates installed plugins, themes, and users, and can test for weak credentials against wp-login. Its fingerprinting goes beyond generic HTTP probing, identifying specific core versions and CVEs, making it the correct choice for a WordPress web application assessment.
- ✗
OpenVAS
Why it's wrong here
OpenVAS is a full-scope network vulnerability scanner that performs port mapping, service discovery, and OS-level CVE enumeration across an entire network. It does not have a WordPress-specific fingerprinting engine or the ability to enumerate plugin/theme versions or test wp-login brute force, so its results are too broad to catch application-level WordPress flaws.
- ✗
Nikto
Why it's wrong here
Nikto is an open-source web server scanner that looks for generic signature issues like default files, insecure CGI binaries, and server header problems. It lacks WordPress-aware logic, so it cannot identify plugin versions from readme.txt or enumerate users through the WordPress REST API, rendering it insufficient for a WordPress-dedicated pen test.
- ✗
Gobuster
Why it's wrong here
Gobuster is a fast directory, file, DNS, and virtual-host enumerator that brute-forces URLs using wordlists, making it useful for discovering hidden paths like /wp-admin or /wp-content/uploads. It does not execute any vulnerability detection or WordPress version/plugin fingerprinting, so even when it finds a path, it cannot assess the target's security posture or identify an exploitable issue.
Go deeper
Related to this question
Learn chapter
Source Code Review for Vulnerabilities
Key term
Fingerprinting
Fingerprinting is the process of gathering information about a target system or network to identify its operating system, services, software versions, and configuration details during the reconnaissance phase of a security assessment.
About these practice questions
Courseiva writes every PT0-003 question from scratch — 777 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.