hardMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester is performing passive…
A penetration tester is performing passive reconnaissance on a target organization. The tester wants to identify internal IP address ranges used by the organization without interacting directly with their network. Which of the following techniques would be most effective for this purpose?
⚠ Common exam trap
CompTIA often tests the distinction between passive and active reconnaissance, and the trap here is that candidates confuse DNS zone transfers (which are active and often restricted) with passive DNS lookups, or assume Shodan is always passive when it actually relies on active scanning data from the past.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Querying public BGP route databases and looking up the organization's autonomous system (AS) number
Querying public BGP route databases (e.g., RADB, ARIN) using the organization's AS number allows a tester to retrieve IP prefixes announced by the target. This is passive reconnaissance because it uses publicly available routing data without sending any packets to the target's network, making it ideal for identifying internal IP ranges from an external perspective.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Querying public BGP route databases and looking up the organization's autonomous system (AS) number
Why this is correct
Public BGP route databases such as RADb, BGPMon, or Hurricane Electric's BGP toolkit aggregate the routing announcements made by organizations' autonomous systems. By identifying the target's ASN, a tester can enumerate all public IP prefixes the organization advertises into the global routing table, including netblocks for data centers, WAN links, or cloud-hosted segments. This method is fully passive because it only queries third-party public data stores and never sends packets to the target's own infrastructure.
- ✗
Performing a DNS zone transfer against the target's authoritative DNS servers
Why it's wrong here
A DNS zone transfer (AXFR query) is a direct, active request sent to the target's authoritative DNS servers, so it cannot be classified as passive reconnaissance. In well-managed environments, AXFR is disabled for external clients, but if misconfigured, it can expose host records and IPs; however, those records are typically limited to published hostnames and do not systematically reveal the internal RFC1918 address ranges used inside the organization. The technique requires live interaction with the target, whereas passive reconnaissance deliberately avoids any contact that could be logged or traced.
- ✗
Using Shodan to search for devices from the target organization
Why it's wrong here
Shodan is an internet-wide scanning service whose historical data can be queried passively, making it a reasonable OSINT tool, but it primarily indexes banners, open ports, and services on directly reachable public IPs. While searching for the organization's hostnames or certificate fingerprints can surface exposed IoT devices and VPN gateways, it does not enumerate the internal address spaces behind the perimeter because RFC1918 ranges are never included in Shodan's data. The core mismatch is that Shodan reveals external exposure, not the internal netblock layout that BGP route records would show.
- ✗
Sending ARP requests on the local network segment to discover hosts
Why it's wrong here
Sending ARP requests is an active scanning technique that injects packets onto a local Ethernet segment and expects live responses from hosts, immediately failing the passive-reconnaissance test. It also requires the tester to already have a foothold on the internal network, which is far beyond a passive external reconnaissance phase. ARP, being confined to a Layer 2 broadcast domain, cannot discover hosts or ranges beyond the immediate subnet and is therefore useless for enumerating an organization's overall IP architecture.
Go deeper
Related to this question
About these practice questions
This PT0-003 question is part of Courseiva's 185-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.