Courseiva
easyMultiple ChoiceObjective-mapped

PT0-002 Practice Question: A penetration tester is conducting passive…

A penetration tester is conducting passive reconnaissance on a target organization. The tester wants to identify the technologies and frameworks used by the target's web application without making any requests to the target's servers. Which resource is BEST suited for this task?

⚠ Common exam trap

Many exam-takers confuse Shodan.io's passive-looking interface with true passive reconnaissance, not realizing that Shodan's data is derived from active scanning, while BuiltWith.com relies on non-intrusive public data aggregation.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

BuiltWith.com

BuiltWith.com is a passive reconnaissance resource that profiles web application technologies by analyzing publicly available data, such as JavaScript libraries, web frameworks, and analytics tools, without sending any requests to the target's servers. It aggregates information from various public sources and historical data, making it ideal for identifying technologies without direct interaction.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Nmap service scan with -sV

    Why it's wrong here

    Nmap is inherently an active tool; running a service scan with -sV sends crafted TCP and UDP probes to the target's open ports to elicit banner responses. The target's firewalls, intrusion detection systems, and application logs will record these connection attempts, and network security devices can flag the scan signature. Passive reconnaissance requires zero direct contact with the target, so using Nmap violates that core principle.

  • Shodan.io

    Why it's wrong here

    Shodan.io is frequently used in reconnaissance, but it is not a passive technique for a specific web application. The data Shodan provides is obtained by its own active scanning of the entire IPv4 address space, where it regularly sends connection probes to common ports and records the resulting banners. While querying Shodan may be passive from the individual tester's perspective, the underlying collection mechanism is active, making it unsuitable as a purely passive reconnaissance method.

  • BuiltWith.com

    Why this is correct

    BuiltWith.com is a passive reconnaissance service that maintains an extensive database of technology profiles harvested from public websites, DNS records, certificate transparency logs, and historical crawl data. By querying BuiltWith, a tester identifies the frameworks, libraries, and analytics tools a target website uses without sending a single packet to the target's servers. Because the information is aggregated from existing public sources, BuiltWith fully satisfies the requirement of passive, non-intrusive intelligence gathering.

  • Wappalyzer browser extension

    Why it's wrong here

    The Wappalyzer browser extension is an active reconnaissance tool because it executes inside the tester's browser when visiting the target site. The extension intercepts and analyzes the live HTTP response headers, HTML DOM, and JavaScript objects served as part of the active page request, which unavoidably generates logs and traffic on the target's infrastructure. This direct interaction is a violation of passive reconnaissance rules; merely using a browser is not passive if it produces a network request to the assessed asset.

About these practice questions

Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.