mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester wants to identify all…
A penetration tester wants to identify all subdomains for a target domain using only public records. Which technique is most effective for this purpose?
⚠ Common exam trap
Test-takers frequently confuse 'public records' with 'active DNS queries' and choose DNS zone transfer (B) or brute-forcing (C), failing to recognize that Certificate Transparency logs are the only passive, public-record-based option listed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Searching crt.sh (Certificate Transparency logs).
Certificate Transparency logs, accessible via crt.sh, are a public record of all SSL/TLS certificates issued for a domain. Since certificates often include Subject Alternative Names (SANs) listing subdomains, querying crt.sh reveals subdomains without any interaction with the target's infrastructure. This technique is passive, requires no authorization, and leverages mandatory logging per RFC 6962, making it highly effective for enumeration from public records.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Searching crt.sh (Certificate Transparency logs).
Why this is correct
Certificate Transparency logs are public, append-only ledgers that record every TLS certificate issued by a trusted CA, including the Subject Alternative Name (SAN) entries. By querying crt.sh for the target domain, you retrieve a historical list of all certificates that referenced the domain or any of its subdomains. Because this data comes from third-party CT log servers rather than the target's own infrastructure, it constitutes passive reconnaissance that generates zero direct traffic to the target.
- ✗
DNS zone transfer.
Why it's wrong here
A DNS zone transfer (AXFR) requests the complete zone file from a target's authoritative name server, which would expose all A, CNAME, and other records, effectively listing every subdomain. However, this is an active technique that requires the target server to permit AXFR from your IP address; virtually all properly hardened DNS servers deny such transfers. Attempting one sends a distinct query to the target's infrastructure and is easily detected, making it a high-risk, low-success approach.
- ✗
Using Nmap to brute-force subdomains.
Why it's wrong here
Nmap's dns-brute script performs active subdomain brute-forcing by sending thousands of DNS queries with a wordlist to the target's name servers or a configured resolver, looking for valid A records. This approach is active because the queries are generated in real time from your host and can be logged or rate-limited by the target's DNS infrastructure, potentially triggering defensive alerts. It also only finds subdomains present in the wordlist, so it misses nonstandard or obscure names and is not passive by any definition.
- ✗
Querying the domain's MX records.
Why it's wrong here
Querying the MX record of a domain only returns the hostnames of the mail servers configured to accept email for that domain, such as mail.example.com. While it might incidentally reveal one or two subdomains related to email handling, it provides no visibility into web, application, API, or other DNS records. This is a simple, limited DNS lookup that does not enumerate the broader subdomain landscape, so it's ineffective for comprehensive passive discovery.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Enumeration
Enumeration is the systematic process of extracting detailed information about a target system, such as user accounts, network shares, services, and configurations, used during the reconnaissance phase of a security assessment.
Key term
Authorization
Authorization determines what an authenticated user is allowed to do within a system, such as accessing files, running programs, or changing settings.
About these practice questions
This PT0-003 question is part of Courseiva's 185-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.