easyMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester is performing passive…
A penetration tester is performing passive reconnaissance to discover email addresses associated with a target domain. The tester wants to avoid sending any packets directly to the target's infrastructure. Which tool is most appropriate for this task?
⚠ Common exam trap
CompTIA often tests the distinction between passive and active reconnaissance, and the trap here is that candidates may confuse 'passive' with 'using public sources' and incorrectly choose Google dorking (Option C) because it seems passive, but theHarvester is the dedicated tool that systematically aggregates email addresses from multiple public sources, making it the most appropriate for this specific task.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Using theHarvester to search public sources like search engines, PGP key servers, and social media
TheHarvester is designed specifically for passive reconnaissance, gathering email addresses, subdomains, and other data from public sources such as search engines, PGP key servers, and social media without sending any packets directly to the target's infrastructure. This aligns perfectly with the requirement to avoid direct interaction with the target domain.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Using the whois command to query domain registration details
Why it's wrong here
The whois command queries the domain registration database via RDAP or WHOIS protocol, exposing registrar details, creation/expiration dates, and administrative/technical contacts. However, these contacts are almost always role-based (e.g., admin@example.com) and are often redacted due to GDPR or domain privacy services, so individual employee email addresses are rarely revealed. Additionally, whois is a single-source lookup and not an aggregator of multiple public sources, making it inefficient for the systematic discovery of employee email addresses during passive reconnaissance.
- ✗
Using Shodan to identify email servers and associated addresses
Why it's wrong here
Shodan is a search engine for internet-connected devices that indexes service banners, SMTP server headers, and TLS certificate metadata collected from active internet-wide scans. While a banner or certificate might incidentally include an email address, Shodan's core focus is on exposed services, open ports, and vulnerabilities, not on harvesting employee email addresses from open-source intelligence. It does not systematically crawl search engines, PGP key servers, or social media profiles for an organization's personnel, so it would produce sparse and incidental contact data rather than a comprehensive list of employee addresses.
- ✗
Using Google dorking with advanced search queries to find email addresses in indexed pages
Why it's wrong here
Google dorking uses advanced search operators like site:example.com and filetype:pdf to uncover email addresses from public web pages and documents. This method is highly manual because it relies on crafting the right query combinations, is limited by search engine rate limits and anti-bot measures, and may miss emails that are obfuscated or located on pages not yet indexed. It only queries web content, lacking the multi-source aggregation that dedicated tools provide, making it a supplementary technique rather than an efficient primary method for employee email discovery.
- ✓
Using theHarvester to search public sources like search engines, PGP key servers, and social media
Why this is correct
theHarvester is a purpose-built passive OSINT tool that queries multiple public data sources, including search engines like Google and Bing, PGP key servers such as keyserver.ubuntu.com, and social media platforms like LinkedIn, then correlates the results to extract employee email addresses, subdomains, and hosts. It sends no packets directly to the target organization's infrastructure, ensuring it remains truly passive and minimizes the chance of detection. Its automated aggregation across diverse source types makes it the superior choice for systematically enumerating employee email addresses early in a penetration test, directly supporting subsequent phishing or social engineering efforts.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Passive reconnaissance
Passive reconnaissance is the process of gathering information about a target system or network without directly interacting with it, using publicly available sources and stealthy observation.
Key term
theHarvester
theHarvester is an open-source intelligence (OSINT) tool used to gather emails, subdomains, IP addresses, and other public data about a target from search engines and public sources.
About these practice questions
One of 185 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.