PT0-002 Vulnerability Discovery and Analysis Practice Question
A tester needs to enumerate Windows domain users and groups from a compromised system. Which PowerShell script would be most useful?
⚠ Common exam trap
Candidates often confuse credential-dumping tools (like Mimikatz) with enumeration tools, or mistake cloud auditing tools (Prowler, ScoutSuite) for Windows domain enumeration scripts, because all are used in post-exploitation but serve fundamentally different purposes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PowerView
PowerView is a PowerShell tool specifically designed for Windows domain enumeration, allowing testers to query Active Directory for users, groups, computers, and permissions via LDAP. It leverages the Active Directory Services Interface (ADSI) to gather detailed information without requiring additional privileges beyond those already obtained on the compromised system.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Invoke-Mimikatz
Why it's wrong here
Invoke-Mimikatz is a PowerShell wrapper for Mimikatz that focuses on credential theft from memory, such as extracting plaintext passwords, NTLM hashes, and Kerberos tickets from the LSASS process. It does not query Active Directory for user or group objects, making it unsuitable for enumeration tasks. While it can be used after compromising a host to aid lateral movement, it does not provide the LDAP-based directory recon required here.
- ✓
PowerView
Why this is correct
PowerView is a PowerShell tool from PowerSploit specifically designed for Active Directory enumeration. It uses LDAP queries to retrieve detailed information about domain users, groups, computers, and ACLs via cmdlets like Get-DomainUser and Get-DomainGroup. This directly fulfills the tester's requirement to enumerate Windows domain users and groups, making it the correct choice.
- ✗
Prowler
Why it's wrong here
Prowler is a security assessment tool for AWS, grounded in CIS benchmarks, and is used to audit cloud infrastructure for misconfigurations, such as IAM policies, S3 bucket permissions, and other AWS-specific controls. It does not interact with on-premises Windows Active Directory or perform LDAP queries. Therefore, it is irrelevant to enumerating Windows domain users and groups.
- ✗
ScoutSuite
Why it's wrong here
ScoutSuite is a multi-cloud security auditing tool that evaluates the configuration of cloud providers like AWS, Azure, and GCP. It checks for insecure cloud settings, such as open storage blobs and weak identity management, but it has no capability to query Windows domains. As a cloud-only tool, it cannot enumerate local AD users or groups, making it incorrect for this task.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PT0-003 question from scratch — 777 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.