mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester is conducting passive…
A penetration tester is conducting passive reconnaissance on a target organization using Google dorking. The tester wants to find PDF documents that may contain usernames and passwords. Which Google search query is most appropriate for this task?
⚠ Common exam trap
CompTIA often tests the distinction between operators that filter by file type (`filetype:`) versus those that search for directory structures (`intitle:'index of'`), causing candidates to confuse passive reconnaissance techniques for document discovery with those for directory enumeration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
site:target.com filetype:pdf password
It uses the `filetype:pdf` operator to specifically target PDF documents, combined with the keyword `password` to find files likely containing credentials. Google dorking with `site:target.com` restricts results to the target domain, making this query efficient for passive reconnaissance of exposed sensitive information in PDFs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
site:target.com filetype:pdf password
Why this is correct
This query combines the site: operator to restrict the domain to target.com, filetype:pdf to limit results to Portable Document Format files, and the term password to surface documents containing that string. It is the most direct way to locate potential credential disclosures because PDFs are commonly used for reports, manuals, and configuration guides that may embed default or hardcoded passwords. Unlike other queries, it precisely targets the document type specified in the objective, minimizing irrelevant HTML or spreadsheet results.
- ✗
site:target.com username password
Why it's wrong here
While this query uses site: to limit to target.com and finds pages containing both username and password, it lacks a filetype filter, so the results can include HTML pages, source code, plain text files, and login forms. Many of these results will be false positives, such as login pages that merely display labels for those fields rather than actual leaked credentials. Without a filetype constraint, the query is far less precise and does not specifically target PDF documents, making it an inefficient reconnaissance technique for this scenario.
- ✗
site:target.com filetype:xls password
Why it's wrong here
This query correctly uses site: to restrict to target.com and adds filetype:xls to find Excel files, but that is the wrong target format; the objective is specifically to find PDF documents. While Excel spreadsheets can also contain credentials, using filetype:xls will cause the search to ignore PDF files entirely, missing the desired data. Additionally, dynamically generated Excel files are often not indexed by search engines as consistently as static PDFs, further reducing the usefulness of this query for the stated goal.
- ✗
site:target.com intitle:'index of' password
Why it's wrong here
This query uses intitle:'index of' to identify Apache-style directory listing pages and requires the term password somewhere on the page. Although directory listings can expose file structures and backup files, they are index pages, not structured documents, so finding actual credential disclosures is indirect and speculative. The word password on such a page might appear only as a filename or in a breadcrumb link, not in a PDF file's content. Therefore, this approach targets a different type of exposure and does not efficiently locate the PDF-specific documents the tester is seeking.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Passive reconnaissance
Passive reconnaissance is the process of gathering information about a target system or network without directly interacting with it, using publicly available sources and stealthy observation.
Key term
Google dorking
Google dorking is the practice of using advanced search operators in Google to uncover sensitive information that companies or individuals unintentionally expose on the internet.
About these practice questions
One of 185 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.