PT0-002 Reconnaissance and Enumeration Practice Question
A penetration tester is performing active reconnaissance on a web application and needs to discover parameters that the application accepts. Which TWO tools are most commonly used for parameter discovery? (Select TWO.)
⚠ Common exam trap
In the CompTIA Pentest+ context, the trap is that candidates often confuse general-purpose web scanners (like Nikto) or CMS-specific tools (like WPScan) with dedicated parameter discovery tools, leading them to select options that perform different reconnaissance tasks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ffuf
ffuf (A) is correct because it is a fast web fuzzer that can brute-force URL parameters, directories, and POST data using wordlists, making it a standard tool for parameter discovery during active reconnaissance. Arjun (E) is correct because it is purpose-built for HTTP parameter discovery, using a large built-in wordlist and heuristics to find hidden GET/POST parameters efficiently. theHarvester (B) is not correct because it focuses on OSINT gathering of emails, subdomains, and hosts from public sources rather than discovering application parameters. WPScan (C) is not correct because it targets WordPress-specific vulnerabilities and enumeration, not generic parameter discovery. Nikto (D) is not correct because it is a web server scanner for misconfigurations and known issues, not a parameter brute-forcing tool.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ffuf
Why this is correct
ffuf performs fuzzing by substituting wordlist entries into request positions, detecting accepted parameters through response differences in status codes, length or reflection. This directly satisfies the stem's requirement to discover parameters the application accepts during active reconnaissance, using its `-w` wordlist and filter flags to isolate valid hits.
- ✗
theHarvester
Why it's wrong here
theHarvester gathers emails, subdomains and hostnames from public sources such as search engines and certificate transparency logs, providing OSINT rather than parameter enumeration. It is tempting during reconnaissance because it maps an organisation's external footprint, but it never interacts with the application's request handling to reveal accepted parameters.
- ✗
WPScan
Why it's wrong here
WPScan fingerprints WordPress core, plugins and themes for known vulnerabilities; it does not discover arbitrary application parameters. It is tempting because it actively probes a web application and reports findings, but its checks are CMS-specific signatures, whereas parameter discovery requires fuzzing query strings, form fields and headers.
- ✗
Nikto
Why it's wrong here
Nikto is a web server scanner that reports outdated software, misconfigurations and known vulnerabilities; it does not enumerate application parameters. It is tempting because it performs active reconnaissance against web targets, but its checks target server banners and files, not the query or form parameters the engagement requires.
- ✓
Arjun
Why this is correct
Arjun brute-forces hidden HTTP parameters using a bundled wordlist, issuing requests with candidate names and flagging those that alter the response. This directly satisfies the stem's requirement to discover parameters the application accepts during active reconnaissance, complementing Burp Suite's parameter-mining capability.
Go deeper
Related to this question
Learn chapter
LinkedIn and Social Media OSINT
Key term
Enumeration
Enumeration is the systematic process of extracting detailed information about a target system, such as user accounts, network shares, services, and configurations, used during the reconnaissance phase of a security assessment.
Key term
OSINT
OSINT (Open Source Intelligence) is the practice of collecting and analyzing publicly available information from free or commercially available sources to support intelligence gathering, cybersecurity assessments, and penetration testing.
About these practice questions
This PT0-003 question is part of Courseiva's 777-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.