easyMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester wants to perform DNS…
A penetration tester wants to perform DNS brute-force enumeration to discover subdomains of a target domain. Which tool is specifically designed for this purpose?
⚠ Common exam trap
Many exam-takers confuse nmap's general DNS script (e.g., dns-brute.nse) with a dedicated tool, but the question specifically asks for a tool 'designed for this purpose,' and dnsrecon is purpose-built for DNS enumeration, whereas nmap's script is an add-on.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
dnsrecon
B is correct because dnsrecon is a specialized DNS enumeration tool that includes a brute-force mode for discovering subdomains. It uses a wordlist to query DNS servers for common subdomain names, leveraging the DNS protocol's inherent structure to map out a target's domain hierarchy without relying on zone transfers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
nmap
Why it's wrong here
Nmap is a network mapping and port scanning tool; while it includes NSE scripts like dns-brute for subdomain enumeration, it is not a purpose-built DNS brute-forcer. Running such scripts requires explicitly loading them and often yields slower, less configurable results than dedicated tools. Its core strength lies in service discovery and vulnerability scanning, making it an inefficient choice for this specific task.
- ✓
dnsrecon
Why this is correct
dnsrecon is a dedicated DNS enumeration tool with a built-in brute-force module that cycles through a wordlist appended to the target domain to discover subdomains. It supports multiple record types (A, AAAA, MX, TXT, etc.), recursion, and threads, and can output results in various formats. This purpose-built design makes it the ideal choice for DNS brute-forcing among the listed options.
- ✗
Wireshark
Why it's wrong here
Wireshark is a passive network protocol analyzer that captures and dissects packets already on the wire. It does not generate DNS queries or possess any brute-force capability; it simply inspects DNS traffic that other hosts generate. Trying to brute-force subdomains with Wireshark would require external tooling to create traffic and then manual analysis, making it an entirely inappropriate tool.
- ✗
Hydra
Why it's wrong here
Hydra is a parallelized network login cracker that targets authentication services such as SSH, FTP, HTTP, and SMB. It brute-forces usernames and passwords, not hostnames or subdomains. While it shares the general concept of trying many guesses, it lacks the DNS-aware logic needed to perform subdomain enumeration, so it cannot fulfill a DNS brute-force request.
Visual reference
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Enumeration
Enumeration is the systematic process of extracting detailed information about a target system, such as user accounts, network shares, services, and configurations, used during the reconnaissance phase of a security assessment.
Key term
DNS enumeration
DNS enumeration is the process of systematically querying a Domain Name System (DNS) server to gather information about a target domain, including its subdomains, IP addresses, and mail server records.
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.