easyMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester is conducting passive…
A penetration tester is conducting passive reconnaissance on a target organization. The tester wants to identify the technologies and frameworks used by the target's web application without making any requests to the target's servers. Which resource is BEST suited for this task?
⚠ Common exam trap
Many exam-takers confuse Shodan.io's passive-looking interface with true passive reconnaissance, not realizing that Shodan's data is derived from active scanning, while BuiltWith.com relies on non-intrusive public data aggregation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
BuiltWith.com
BuiltWith.com is a passive reconnaissance resource that profiles web application technologies by analyzing publicly available data, such as JavaScript libraries, web frameworks, and analytics tools, without sending any requests to the target's servers. It aggregates information from various public sources and historical data, making it ideal for identifying technologies without direct interaction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Nmap service scan with -sV
Why it's wrong here
Nmap is inherently an active tool; running a service scan with -sV sends crafted TCP and UDP probes to the target's open ports to elicit banner responses. The target's firewalls, intrusion detection systems, and application logs will record these connection attempts, and network security devices can flag the scan signature. Passive reconnaissance requires zero direct contact with the target, so using Nmap violates that core principle.
- ✗
Shodan.io
Why it's wrong here
Shodan.io is frequently used in reconnaissance, but it is not a passive technique for a specific web application. The data Shodan provides is obtained by its own active scanning of the entire IPv4 address space, where it regularly sends connection probes to common ports and records the resulting banners. While querying Shodan may be passive from the individual tester's perspective, the underlying collection mechanism is active, making it unsuitable as a purely passive reconnaissance method.
- ✓
BuiltWith.com
Why this is correct
BuiltWith.com is a passive reconnaissance service that maintains an extensive database of technology profiles harvested from public websites, DNS records, certificate transparency logs, and historical crawl data. By querying BuiltWith, a tester identifies the frameworks, libraries, and analytics tools a target website uses without sending a single packet to the target's servers. Because the information is aggregated from existing public sources, BuiltWith fully satisfies the requirement of passive, non-intrusive intelligence gathering.
- ✗
Wappalyzer browser extension
Why it's wrong here
The Wappalyzer browser extension is an active reconnaissance tool because it executes inside the tester's browser when visiting the target site. The extension intercepts and analyzes the live HTTP response headers, HTML DOM, and JavaScript objects served as part of the active page request, which unavoidably generates logs and traffic on the target's infrastructure. This direct interaction is a violation of passive reconnaissance rules; merely using a browser is not passive if it produces a network request to the assessed asset.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.