hardMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester is performing internal…
A penetration tester is performing internal reconnaissance on a Windows Active Directory environment. The tester has a low-privileged domain user account. Which of the following techniques is most likely to help identify all domain controllers and their IP addresses without generating excessive network traffic or alerts?
⚠ Common exam trap
Watch out — candidates often default to active scanning techniques like Nmap ping sweeps (Option A) because they are familiar, overlooking that DNS SRV record queries are a passive, targeted, and far more efficient method for discovering domain controllers in an Active Directory environment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Query the DNS service for SRV records of _ldap._tcp.dc._msdcs.domain.local
Querying DNS for SRV records of _ldap._tcp.dc._msdcs.domain.local is a standard, low-noise method to discover all domain controllers in an Active Directory environment. This query leverages the automatic registration of LDAP service records by domain controllers, requiring only a single DNS lookup rather than sweeping the network, thus avoiding excessive traffic and typical security alerts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perform a full subnet ping sweep using Nmap
Why it's wrong here
A full subnet ping sweep with Nmap is an overt, active reconnaissance technique that sends ICMP echo requests or TCP probes (for example, -sn with ACK/SYN) to every IP address in the range. This generates substantial network traffic and can be easily logged or flagged by IDS/IPS, which defeats the stealth objective of internal recon. Additionally, many modern hosts and security controls drop ICMP, so the sweep may miss active systems or produce noisy, unreliable results. The goal is to locate domain controllers with minimal footprint, and a broadcast scan is anything but minimal.
- ✓
Query the DNS service for SRV records of _ldap._tcp.dc._msdcs.domain.local
Why this is correct
Querying DNS for the SRV record _ldap._tcp.dc._msdcs.domain.local is the correct, low-noise method because it leverages a standard LDAP service locator record that every domain controller registers with the DNS server. This is a routine client-to-DNS lookup that domain-joined machines perform constantly, so security monitoring tools typically do not treat it as suspicious. The query returns the hostnames and port numbers of all available domain controllers in the domain, giving the tester a direct, accurate list without generating scan traffic or touching the target systems themselves. It is effectively passive enumeration that blends in with normal network operations.
- ✗
Use NetBIOS name resolution by sending broadcasts
Why it's wrong here
Using NetBIOS name resolution broadcasts to find domain controllers is a legacy approach that relies on the NetBIOS over TCP/IP (NetBT) protocol, which modern Active Directory environments often disable in favor of DNS. Broadcasts are sent to the local subnet and may be forwarded by routers only if specifically configured, so they frequently fail to reach all DCs or elicit a response from non-NetBIOS hosts. Even when NetBIOS is enabled, this method sends broadcast traffic across the network segment, which can be monitored by network defenders and is more intrusive than a single unicast DNS query. It is also less reliable because NetBIOS names do not map cleanly to the AD DS SRV records that actually advertise domain controller services.
- ✗
Enumerate SMB shares on all IP addresses in the subnet
Why it's wrong here
Enumerating SMB shares on every IP in the subnet is an invasive, non-targeted technique that attempts to connect to the administrative IPC$ share and list any available shares on each host. This process requires establishing a full SMB session with each live system, potentially including an authentication attempt, which generates significant network chatter and is recorded in the target's security event logs (for example, Event ID 5140) and can trigger alerts on modern EDR or IDS solutions. It also does not directly identify domain controllers; instead, it maps the SMB footprint of the whole network, leaving a broad forensic trail while still requiring the tester to manually correlate results to find the DCs. A focused DNS SRV query accomplishes the objective with a single, ordinary protocol request.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.