The correct choice is passive DNS enumeration using public data sources. This technique is ideal because it allows a penetration tester to discover subdomains of a target domain without sending any queries to the target’s authoritative DNS servers, thereby avoiding detection by logging or monitoring systems. Instead, it relies on publicly available data such as certificate transparency logs, search engine caches, and passive DNS databases like VirusTotal or SecurityTrails. On the CompTIA PenTest+ PT0-002 exam, this question tests your understanding of stealthy reconnaissance methods versus active techniques that generate direct traffic. A common trap is confusing passive enumeration with brute-force or zone transfer attacks, which are active and easily detected. Remember the memory tip: “Passive pulls from public piles, active asks the target directly.”
PT0-002 Practice Question: Information Gathering and Vulnerability Scanning
This PT0-002 practice question tests your understanding of information gathering and vulnerability scanning. Compare every option against the stated constraints before choosing — the best answer satisfies all requirements, not just the most obvious one. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A penetration tester wants to discover all subdomains of a target domain without directly querying the target's DNS servers to avoid detection. Which technique is most appropriate?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Passive DNS enumeration using public data sources
Passive DNS enumeration leverages public data sources such as certificate transparency logs, search engine caches, and passive DNS databases (e.g., VirusTotal, SecurityTrails) to discover subdomains without sending any queries to the target's authoritative DNS servers. This approach avoids generating DNS traffic that could be logged or detected by the target's monitoring systems, making it ideal for stealthy reconnaissance.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
DNS zone transfer
Why it's wrong here
Zone transfer is an active technique that directly queries the target's DNS servers, which would be detected.
✗
Brute-force subdomain enumeration using a wordlist
Why it's wrong here
Brute-force enumeration generates many DNS queries to the target's servers, which is active and can be logged.
✓
Passive DNS enumeration using public data sources
Why this is correct
Passive enumeration relies on publicly available records and does not require sending packets to the target, thus avoiding detection.
Related concept
Read the scenario before looking for a memorised answer.
✗
SNMP community string enumeration
Why it's wrong here
SNMP enumeration targets network devices and is not used for subdomain discovery.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may confuse passive enumeration with brute-force or zone transfer techniques, overlooking the explicit requirement to avoid direct DNS queries and detection, which only passive methods satisfy.
Detailed technical explanation
How to think about this question
Passive DNS enumeration often relies on Certificate Transparency (CT) logs, which are publicly auditable records of SSL/TLS certificates issued by Certificate Authorities (CAs). Since certificates often include Subject Alternative Names (SANs) listing subdomains, tools like crt.sh can extract subdomains without any network interaction with the target. This technique is particularly effective for discovering subdomains that are not publicly indexed by search engines but are present in CT logs due to recent certificate issuance.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A developer is choosing between AES-256 (symmetric) and RSA-2048 (asymmetric) for encrypting a large file that will be sent to a partner. Symmetric encryption is fast but requires key exchange; asymmetric is slower but solves the key distribution problem. A hybrid approach — encrypt the file with AES, encrypt the AES key with RSA — is standard. Questions like this test whether you understand when each approach applies.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this PT0-002 question in full detail.
Information Gathering and Vulnerability Scanning — This question tests Information Gathering and Vulnerability Scanning — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Passive DNS enumeration using public data sources — Passive DNS enumeration leverages public data sources such as certificate transparency logs, search engine caches, and passive DNS databases (e.g., VirusTotal, SecurityTrails) to discover subdomains without sending any queries to the target's authoritative DNS servers. This approach avoids generating DNS traffic that could be logged or detected by the target's monitoring systems, making it ideal for stealthy reconnaissance.
What should I do if I get this PT0-002 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A penetration tester is conducting passive reconnaissance on a target organization. Which technique can be used to discover subdomains of the target's domain without sending any packets to the target's network?
easy
A.Performing a DNS brute-force attack against the target's domain
✓ B.Using the 'site:' operator in a search engine query
C.Sending ICMP echo requests to potential subdomain IP addresses
D.Querying WHOIS databases for domain registration information
Why B: Option B is correct because using the 'site:' operator in a search engine query (e.g., 'site:example.com') retrieves indexed subdomains from the search engine's cache without sending any packets to the target's network. This is a purely passive technique that leverages publicly available data, aligning with the definition of passive reconnaissance.
Variation 2. A penetration tester is conducting passive reconnaissance on a target organization. Which of the following techniques would provide the MOST useful information about internal network architecture without directly interacting with the target's systems?
medium
A.Performing a zone transfer against the target's DNS servers
✓ B.Searching for the target's SSL certificates in Certificate Transparency logs
C.Using Nmap to scan common ports on the target's public IP range
D.Querying the target's WHOIS records for IP addresses
Why B: Certificate Transparency (CT) logs are publicly accessible, append-only ledgers of SSL/TLS certificates. By searching CT logs for certificates issued to the target organization, a penetration tester can discover subdomains, hostnames, and even internal-facing server names that are included in Subject Alternative Names (SANs) or Common Names (CNs). This reveals internal network architecture details (e.g., 'mail.internal.example.com') without any direct interaction with the target's systems, making it a purely passive reconnaissance technique.
Variation 3. A penetration tester wants to discover subdomains of a target domain without sending any packets directly to the target's network. Which resource is most effective for this purpose?
easy
A.DNS brute force with a wordlist
✓ B.Certificate Transparency logs
C.WHOIS lookup
D.Traceroute
Why B: Certificate Transparency (CT) logs are publicly accessible, append-only ledgers that record every SSL/TLS certificate issued by a Certificate Authority (CA). Since certificates often include Subject Alternative Names (SANs) listing subdomains, querying CT logs (e.g., via crt.sh or tools like `certigo`) reveals subdomains without any direct network probes. This makes CT logs the most effective passive reconnaissance resource, as no packets are sent to the target's infrastructure.
Variation 4. A penetration tester wants to identify all subdomains for a target domain using only public records. Which technique is most effective for this purpose?
Why A: Certificate Transparency logs, accessible via crt.sh, are a public record of all SSL/TLS certificates issued for a domain. Since certificates often include Subject Alternative Names (SANs) listing subdomains, querying crt.sh reveals subdomains without any interaction with the target's infrastructure. This technique is passive, requires no authorization, and leverages mandatory logging per RFC 6962, making it highly effective for enumeration from public records.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.