hardMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester wants to identify the web…
A penetration tester wants to identify the web server software and version used by a target organization without sending any packets to the target's infrastructure. Which of the following techniques is most effective for this purpose?
⚠ Common exam trap
Many candidates confuse passive reconnaissance with low-and-slow active scanning, mistakenly believing that techniques like delayed nmap scans or netcat connections are passive when they still generate detectable network traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Shodan to search for the target's IP address or domain and review the gathered banners.
Shodan is a search engine that continuously scans the internet and stores service banners from various ports. By querying the target's IP address or domain, the penetration tester can retrieve previously collected HTTP headers and other service banners without sending any packets to the target, thus achieving passive reconnaissance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use Shodan to search for the target's IP address or domain and review the gathered banners.
Why this is correct
Shodan is a search engine for internet-connected devices that continuously crawls the web and stores service banners, including HTTP Server headers, from historical scans. Querying Shodan by the target's IP address or domain is a purely passive reconnaissance technique because it retrieves already-collected data without sending a single packet to the target. This makes it ideal for stealthy initial fingerprinting, as it reveals the web server software and version without any risk of detection or direct interaction.
- ✗
Perform a DNS zone transfer to obtain internal server information.
Why it's wrong here
A DNS zone transfer is an active query that sends a request to the DNS server. Many servers restrict zone transfers, and even if successful, the data obtained does not typically include web server software versions.
- ✗
Use netcat to connect to port 80 and read the HTTP banner.
Why it's wrong here
Netcat connecting to port 80 is an active reconnaissance technique because it establishes a raw TCP session with the target and sends an HTTP request (often a simple GET or HEAD) to elicit a response. The server's HTTP banner is returned only after this direct interaction, which means the target's logs will record the connection and the request. Therefore, while netcat can certainly identify web server software, it is not passive and may alert defenders or trigger intrusion detection systems.
- ✗
Use nmap -sV with a delayed scan to avoid detection.
Why it's wrong here
Nmap version detection (-sV) sends a series of crafted probes to open ports to actively elicit and match responses against its service fingerprint database. Even with a delayed timing template (e.g., -T0 or -T1), the scan still generates network traffic to the target, making it active and potentially detectable by network monitoring or host-based defenses. Additionally, version detection probes are often more conspicuous than simple banner grabs, increasing the likelihood of alerting the target's security controls.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Passive reconnaissance
Passive reconnaissance is the process of gathering information about a target system or network without directly interacting with it, using publicly available sources and stealthy observation.
Key term
Shodan
Shodan is a search engine that lets you find specific types of internet-connected devices, such as webcams, routers, and servers, by scanning the internet and indexing their services and banners.
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.