mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester is performing passive…
A penetration tester is performing passive reconnaissance on a target organization. The tester wants to gather information about the target's technology stack, including web server software and frameworks, without directly interacting with the target systems. Which technique is most effective?
⚠ Common exam trap
It's easy for candidates to confuse passive reconnaissance with low-interaction active tools like Nmap's -A flag, failing to recognize that any direct network probing constitutes active reconnaissance, even if it's just a single scan.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Querying public records with BuiltWith
BuiltWith is a passive reconnaissance tool that queries public web data and DNS records to identify a target's technology stack, such as web server software (e.g., Apache, Nginx) and frameworks (e.g., React, Django), without sending any packets to the target's systems. This makes it ideal for passive information gathering, as it relies on third-party databases and cached information rather than direct interaction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Running Nmap with the -A flag against the target's public IP range
Why it's wrong here
Running Nmap with the -A flag is an active reconnaissance technique because Nmap sends raw packets to the target host to elicit responses. The -A flag specifically enables OS detection, version detection, script scanning, and traceroute, all of which require direct, interactive traffic with the target's network stack. This violates the fundamental requirement of passive reconnaissance, because the target's logging systems can detect the incoming probes.
- ✗
Using theHarvester to search for email addresses and subdomains
Why it's wrong here
TheHarvester is an OSINT tool that queries public data sources such as search engines, PGP key servers, and certificate transparency logs to collect email addresses, subdomains, and hostnames. While it does operate in a passive or semi-passive manner depending on the source, its primary output is harvested user-related data rather than a comprehensive technology stack profile. It may incidentally reveal some tech clues from domain names or headers, but it lacks the structured, deep technology fingerprinting that BuiltWith provides.
- ✓
Querying public records with BuiltWith
Why this is correct
BuiltWith is a technology-profile lookup service that aggregates data from its own web crawlers, DNS records, and other public repositories. By querying BuiltWith's API or website, the tester retrieves detailed information about a target's web server, JavaScript frameworks, content management system, analytics tools, and other technology components without sending any packets to the target's infrastructure. This makes it a passive reconnaissance technique because the target never sees direct traffic from the tester, even though a third party (BuiltWith) may have actively scanned the site previously.
- ✗
Performing a DNS zone transfer
Why it's wrong here
Performing a DNS zone transfer is an active reconnaissance technique because it directly queries the target's authoritative DNS server using a SOA request followed by an AXFR query. If the server is misconfigured to allow zone transfers, the attacker receives a complete listing of DNS records, but the request itself is evident in the server logs and creates network traffic. Zone transfer is also often unsuccessful because most properly configured DNS servers restrict AXFR to specific secondary servers, so it is both active and unreliable.
Visual reference
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Passive reconnaissance
Passive reconnaissance is the process of gathering information about a target system or network without directly interacting with it, using publicly available sources and stealthy observation.
Key term
Active reconnaissance
Active reconnaissance is the process of directly interacting with a target system or network to gather information, often through scanning and probing.
About these practice questions
This PT0-003 question is part of Courseiva's 185-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.