easyMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester wants to identify all…
A penetration tester wants to identify all publicly accessible Amazon S3 buckets that belong to a specific organization. Which technique is most effective for passive reconnaissance?
⚠ Common exam trap
CompTIA often tests the distinction between passive and active reconnaissance, and the trap here is that candidates confuse DNS queries (which are active) with passive techniques like search engine dorking, or assume that scanning IP ranges is a valid way to discover S3 buckets when in reality S3 buckets are identified by their DNS names, not by port scanning.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Google dorks to search for bucket names and URLs.
Google dorks (e.g., site:s3.amazonaws.com "companyname") allow a penetration tester to passively discover publicly accessible S3 bucket names and URLs indexed by search engines without sending any traffic to the target organization. This technique leverages existing search engine caches, making it purely passive and highly effective for identifying misconfigured buckets that have been crawled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use Google dorks to search for bucket names and URLs.
Why this is correct
Google dorking is a passive reconnaissance technique that leverages search engines' indexed data to find publicly exposed S3 bucket names embedded in URLs (e.g., site:s3.amazonaws.com combined with company keywords). Because it queries Google's cache rather than accessing AWS or the target's infrastructure directly, it leaves no trace in target logs and is ideal for stealthy initial enumeration.
- ✗
Send DNS queries for common bucket name prefixes.
Why it's wrong here
Sending DNS queries for common bucket name prefixes is an active method that generates logs at the queried resolvers and potentially the target's authoritative servers, alerting the target to reconnaissance activity. S3 bucket names are globally unique and do not follow predictable hostname patterns—they often include random strings or internal project codes—so brute-forcing prefixes yields a very low success rate and is unreliable without additional context.
- ✗
Use nmap to scan all AWS IP ranges for open ports.
Why it's wrong here
Running an nmap scan across all AWS IP ranges is not only overt, generating enormous traffic that violates AWS acceptable use policies and may even trigger legal action, but it is also technically ineffective: S3 buckets are served via shared, load-balanced HTTPS endpoints (e.g., https://s3.amazonaws.com/), not assigned unique public IPs for each bucket, so port scanning cannot identify bucket names or determine which buckets exist.
- ✗
Perform a DNS zone transfer on the target organization's domain.
Why it's wrong here
Performing a DNS zone transfer (AXFR) is an active technique that only succeeds if the target's nameserver is misconfigured to allow external transfers—a rarity in modern DNS administration. Even when successful, AXFR enumerates traditional DNS records like A, CNAME, and MX for the organization's own domain; it would not reveal S3 bucket names unless explicit CNAME entries point to s3.amazonaws.com, and even then, only a subset of buckets is exposed, not all publicly accessible ones.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.