PT0-002 Reconnaissance and Enumeration Practice Question
A penetration tester is performing passive reconnaissance and wants to identify subdomains associated with a target domain without directly querying the target's DNS servers. Which tool is specifically designed for this purpose?
⚠ Common exam trap
The trap is that candidates often confuse passive reconnaissance with tools that perform subdomain enumeration via active queries (e.g., Gobuster or Nmap's dns-brute script), causing them to overlook theHarvester's passive data collection from public sources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
theHarvester
TheHarvester is specifically designed for passive reconnaissance, gathering subdomains from public sources like search engines (Google, Bing), PGP key servers, and the Shodan database without querying the target's DNS servers directly. This aligns with the requirement to avoid direct interaction with the target's infrastructure, making it the correct choice for passive subdomain enumeration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
WPScan
Why it's wrong here
WPScan enumerates WordPress plugins, themes and users via HTTP requests to a WordPress site; it has no subdomain discovery capability and queries the target directly. It would be the right choice when fingerprinting a known WordPress installation during vulnerability assessment, not for passive subdomain enumeration.
- ✗
Nmap
Why it's wrong here
Nmap performs active scanning, sending probes to target hosts and their DNS servers, which violates the passive-only requirement. It is tempting because Nmap is a reconnaissance staple, and it would be correct for active host discovery or port scanning rather than passive subdomain enumeration.
- ✓
theHarvester
Why this is correct
theHarvester aggregates subdomains from public sources such as search engines, certificate transparency logs and OSINT datasets, so no packets reach the target's authoritative DNS servers. That satisfies the passive-reconnaissance constraint in the stem, unlike active brute-forcing or zone-transfer tools that query the domain directly.
- ✗
Gobuster
Why it's wrong here
Gobuster performs active brute-forcing of subdomains by sending DNS queries directly to the target's resolvers, which the scenario explicitly forbids. It is tempting because it does enumerate subdomains effectively, but only in active reconnaissance engagements where direct interaction with target DNS infrastructure is permitted.
Visual reference
Go deeper
Related to this question
Learn chapter
LDAP and Active Directory Enumeration
Key term
Enumeration
Enumeration is the systematic process of extracting detailed information about a target system, such as user accounts, network shares, services, and configurations, used during the reconnaissance phase of a security assessment.
Key term
Shodan
Shodan is a search engine that lets you find specific types of internet-connected devices, such as webcams, routers, and servers, by scanning the internet and indexing their services and banners.
About these practice questions
Courseiva writes every PT0-003 question from scratch — 777 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.