easyMultiple Select
PT0-002 Practice Question: A penetration tester needs to perform initial…
A penetration tester needs to perform initial reconnaissance on a target domain. Which of the following tools are specifically designed for domain enumeration? (Select TWO).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
theHarvester
theHarvester (C) is specifically designed for domain enumeration, as it gathers emails, subdomains, hosts, employee names, open ports, and banners from public sources like search engines and PGP key servers. recon-ng (E) is a full-featured web reconnaissance framework whose modules perform domain enumeration tasks such as subdomain discovery, DNS lookups, and contact harvesting. Wireshark (A) is a packet capture and protocol analyzer used for traffic inspection, not domain enumeration. Metasploit (B) is an exploitation framework, and while it has auxiliary scanning modules, it is not specifically designed for domain enumeration. Netcat (D) is a general-purpose networking utility for reading/writing TCP/UDP connections, not a domain enumeration tool.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Wireshark
Why it's wrong here
Wireshark captures and analyses packet data on an interface; it performs no DNS record or subdomain discovery. It is tempting because captured DNS traffic can reveal names, and it would be correct if the task were passive traffic analysis rather than active domain enumeration.
- ✗
Metasploit
Why it's wrong here
Metasploit is an exploitation framework, not a domain enumeration tool; it lacks DNS, subdomain and WHOIS querying. It is tempting because its auxiliary modules can perform some scanning, making it the right choice for vulnerability exploitation or payload delivery once reconnaissance has already identified live hosts and services.
- ✓
theHarvester
Why this is correct
theHarvester harvests emails, subdomains, hosts and employee names from public sources such as search engines and certificate transparency logs, performing passive OSINT against a target domain. It requires no prior credentials, matching the initial reconnaissance constraint of enumerating domain assets without touching the target directly.
- ✗
Netcat
Why it's wrong here
Netcat is a general-purpose TCP/UDP connection and listener tool, lacking DNS or subdomain enumeration features. It is tempting because testers use it for banner grabbing and port probing, and it would be correct if the task were manual service interaction rather than domain enumeration.
- ✓
recon-ng
Why this is correct
recon-ng is a modular reconnaissance framework whose modules query public sources for hosts, contacts and domain records, storing results in a workspace database. It supports passive domain enumeration during initial reconnaissance, satisfying the requirement to gather target domain information before active testing begins.
Visual reference
Go deeper
Related to this question
Learn chapter
Persistence Mechanisms: Scheduled Tasks, Registry
Key term
Enumeration
Enumeration is the systematic process of extracting detailed information about a target system, such as user accounts, network shares, services, and configurations, used during the reconnaissance phase of a security assessment.
Key term
theHarvester
theHarvester is an open-source intelligence (OSINT) tool used to gather emails, subdomains, IP addresses, and other public data about a target from search engines and public sources.
About these practice questions
This PT0-003 question is part of Courseiva's 777-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.