easyMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester is conducting passive…
A penetration tester is conducting passive reconnaissance on a target organization. The tester wants to identify all publicly accessible cloud storage buckets that might belong to the target without directly interacting with the target's infrastructure. Which of the following techniques would be most effective for this purpose?
⚠ Common exam trap
Test-takers frequently confuse passive reconnaissance with techniques that appear passive but actually generate direct network queries (like DNS enumeration), or they may overlook that certificate transparency logs reveal domains, not storage buckets, leading them to choose a technically passive but functionally irrelevant option.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Search for exposed cloud storage buckets using search engine dorks (e.g., 'site:s3.amazonaws.com target-company')
Search engine dorks allow a penetration tester to query publicly indexed content on cloud storage platforms like AWS S3 without sending any traffic to the target's infrastructure. By using a dork such as 'site:s3.amazonaws.com target-company', the tester leverages the search engine's pre-cached index to identify buckets that may be misconfigured or publicly accessible, which aligns perfectly with passive reconnaissance requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perform DNS enumeration using tools like `dnsrecon` to discover subdomains pointing to cloud storage services
Why it's wrong here
DNS enumeration with dnsrecon is not truly passive because it sends explicit DNS queries that can be logged by the target's name servers, especially if split-horizon DNS or query logging is in place. Moreover, discovering a subdomain like storage.target.com does not directly reveal the underlying bucket name, and additional active queries would be needed to test for public cloud storage. This option violates the passive requirement and lacks a direct mapping to cloud bucket identifiers.
- ✓
Search for exposed cloud storage buckets using search engine dorks (e.g., 'site:s3.amazonaws.com target-company')
Why this is correct
Search engine dorking, such as using `site:s3.amazonaws.com` combined with the target's company name, is a classic passive reconnaissance technique because it queries only the search engine's cached index, never touching the target's infrastructure. Misconfigured cloud storage buckets are often publicly indexed by crawlers, allowing the tester to discover bucket names, region prefixes, and even exposed objects without generating any network traffic to the victim. This makes it uniquely suited to the stated requirement of passive information gathering.
- ✗
Query certificate transparency logs to find SSL certificates issued to the target's cloud storage endpoints
Why it's wrong here
Certificate transparency logs are public, append-only records of issued TLS certificates, and querying them is indeed passive, but they typically list hostnames and domains, not cloud storage bucket names. Buckets like `mybucket.s3.amazonaws.com` usually rely on the cloud provider's shared certificates rather than being issued their own TLS certs, so scanning CT logs for the target's domain rarely yields bucket identifiers. The technique is passive but ineffective for this specific objective because it targets a certificate ecosystem that cloud buckets generally do not participate in.
- ✗
Perform a WHOIS lookup to find IP ranges owned by the target and then scan those ranges for open storage services
Why it's wrong here
While the initial WHOIS query is passive, the proposed follow-up of scanning the target's owned IP ranges for open storage services is active reconnaissance, as it sends packets to the target's network and can be detected by IDS/IPS or firewall logs. Additionally, cloud storage buckets are not typically hosted on a company's own IP ranges; they exist in shared cloud provider address space (e.g., Amazon's S3 endpoints), so scanning the target's netblocks is both intrusive and unlikely to find the intended buckets. This option violates the passive constraint and is technically misdirected.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.