The answer is analyzing job postings for technical requirements, as this passive reconnaissance technique reveals a company’s internal IP scheme without any direct network connection. By scanning job listings for required subnet masks like /24 or /16, or specific private ranges such as 10.x.x.x or 192.168.x.x, a tester can infer the internal addressing structure from publicly available information. On the CompTIA PenTest+ PT0-002 exam, this question tests your understanding of passive vs. active reconnaissance—a common trap is choosing active methods like DNS zone transfers or ping sweeps, which create detectable traffic. The key is that job postings are a goldmine of unintentional leaks, often overlooked by organizations. Memory tip: “Jobs leak the net”—job ads reveal network ranges without a single packet sent.
PT0-002 Practice Question: Information Gathering and Vulnerability Scanning
This PT0-002 practice question tests your understanding of information gathering and vulnerability scanning. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: job postings can inadvertently reveal internal network details.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A penetration tester is performing reconnaissance on a target organization. The tester wants to discover the internal IP address scheme used by the company without making any direct connections to the company's network. Which technique is MOST effective for this purpose?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Analyzing job postings for technical requirements
Analyzing job postings for technical requirements is the most effective technique because it allows the tester to infer the internal IP address scheme without making any direct connections to the target network. Job postings often list specific technical skills, such as experience with certain subnet masks (e.g., /24, /16) or network ranges (e.g., 10.x.x.x, 192.168.x.x), which can reveal the internal addressing structure used by the organization. This passive reconnaissance method relies on publicly available information, avoiding any network traffic that could trigger detection.
Key principle: Job postings can inadvertently reveal internal network details.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
DNS zone transfer
Why it's wrong here
Requires a misconfigured DNS server and direct communication; not passive and often fails.
✗
WHOIS lookup
Why it's wrong here
Provides domain and registrar information, not internal network details.
✓
Analyzing job postings for technical requirements
Why this is correct
Job ads often list specific technologies, IP ranges, or infrastructure details inadvertently.
Related concept
Job postings can inadvertently reveal internal network details.
✗
Using Shodan to find exposed devices
Why it's wrong here
Shodan indexes internet-facing devices, not internal IP schemes which are not directly exposed.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often assume DNS zone transfer (Option A) is the best passive technique, but they overlook that it requires an active query and is rarely successful due to security controls, while job postings are a truly passive and often overlooked source of internal network information.
Detailed technical explanation
How to think about this question
Under the hood, job postings may include specific requirements such as 'experience with Cisco routers using OSPF in a /16 subnet' or 'knowledge of VLAN segmentation with 10.0.0.0/8', which directly leak internal addressing. In real-world scenarios, organizations often inadvertently expose their internal network design through job descriptions, especially for roles like network administrators or security engineers, making this a valuable OSINT (Open Source Intelligence) technique. This method aligns with the passive reconnaissance phase of the PTES (Penetration Testing Execution Standard), where no packets are sent to the target.
KKey Concepts to Remember
Job postings can inadvertently reveal internal network details.
This technique is entirely passive, requiring no direct interaction.
Information gathered includes OS, virtualization, and network device types.
It helps build a target profile before active engagement.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Job postings can inadvertently reveal internal network details.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Job postings can inadvertently reveal internal network details. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this PT0-002 question in full detail.
Review job postings can inadvertently reveal internal network details., then practise related PT0-002 questions on the same topic to reinforce the concept.
Information Gathering and Vulnerability Scanning — This question tests Information Gathering and Vulnerability Scanning — Job postings can inadvertently reveal internal network details..
What is the correct answer to this question?
The correct answer is: Analyzing job postings for technical requirements — Analyzing job postings for technical requirements is the most effective technique because it allows the tester to infer the internal IP address scheme without making any direct connections to the target network. Job postings often list specific technical skills, such as experience with certain subnet masks (e.g., /24, /16) or network ranges (e.g., 10.x.x.x, 192.168.x.x), which can reveal the internal addressing structure used by the organization. This passive reconnaissance method relies on publicly available information, avoiding any network traffic that could trigger detection.
What should I do if I get this PT0-002 question wrong?
Review job postings can inadvertently reveal internal network details., then practise related PT0-002 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Job postings can inadvertently reveal internal network details.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.