The answer is banner grabbing. This script uses the Python socket module to establish a TCP connection, send a crafted HTTP GET request, and then capture the response, which is the core technical process of banner grabbing—a manual, low-level technique for service identification that retrieves the version or type of software running on a target port. On the CompTIA PenTest+ PT0-002 exam, this concept tests your understanding of reconnaissance methods and the distinction between active service fingerprinting and automated scanning tools like Nmap; a common trap is confusing banner grabbing with port scanning, but the key difference is that banner grabbing specifically targets the response payload after a connection is made, not just the open port. To remember this, think of the script as a digital handshake: you send a greeting (the GET request) and read the name tag (the banner) that comes back.
PT0-002 Tools and Code Analysis Practice Question
This PT0-002 practice question tests your understanding of tools and code analysis. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: banner grabbing retrieves service version and type information.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A penetration tester is analyzing a Python script that uses the 'socket' module to create a TCP connection to a target IP and port. The script then sends a payload (e.g., 'GET / HTTP/1.0\r\n\r\n') and waits for a response. Which tool function is this script most likely performing?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Banner grabbing
The script creates a TCP connection, sends an HTTP GET request, and waits for a response. This is the classic behavior of banner grabbing, where the goal is to retrieve the service banner (e.g., HTTP server version) from the target. The 'socket' module is used to manually craft the connection and payload, which is a low-level technique for service identification, not for scanning multiple ports or assessing vulnerabilities.
Key principle: Banner grabbing retrieves service version and type information.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Port scanning
Why it's wrong here
The script targets a single port, not a range, so it is not port scanning.
✓
Banner grabbing
Why this is correct
Sending a payload and reading the response is the typical method for banner grabbing.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Banner grabbing retrieves service version and type information.
✗
Vulnerability scanning
Why it's wrong here
Vulnerability scanning involves more complex probes and checks than a simple banner request.
✗
Password cracking
Why it's wrong here
Password cracking would involve sending login credentials, not just a service request.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may confuse banner grabbing with port scanning because both involve connecting to a port, but banner grabbing focuses on service identification from a single connection, not enumeration of open ports.
Detailed technical explanation
How to think about this question
Banner grabbing works by sending a protocol-specific probe (e.g., 'GET / HTTP/1.0\r\n\r\n' for HTTP) and parsing the response, which often includes a server header like 'Apache/2.4.41'. This technique is part of the reconnaissance phase and can be performed with tools like Netcat or Telnet, but the Python socket script provides fine-grained control over timeouts and payloads. A subtle behavior is that some services require a trailing newline or specific CRLF sequences to trigger a banner.
KKey Concepts to Remember
Banner grabbing retrieves service version and type information.
It typically involves sending a standard protocol request (e.g., HTTP GET) to an open port.
The 'socket' module in Python can be used to perform banner grabbing.
Banners can reveal OS, service name, and version, aiding vulnerability identification.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Banner grabbing retrieves service version and type information.
Real-world example
How this comes up in practice
A security team runs a vulnerability scan on a web application and discovers an unpatched SQL injection flaw. The team prioritises remediation by CVSS score — critical flaws are patched within 24 hours, high within 7 days. Questions like this test whether you understand vulnerability management processes, scanning tools, and remediation prioritisation.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this PT0-002 question in full detail.
Review banner grabbing retrieves service version and type information., then practise related PT0-002 questions on the same topic to reinforce the concept.
Tools and Code Analysis — This question tests Tools and Code Analysis — Banner grabbing retrieves service version and type information..
What is the correct answer to this question?
The correct answer is: Banner grabbing — The script creates a TCP connection, sends an HTTP GET request, and waits for a response. This is the classic behavior of banner grabbing, where the goal is to retrieve the service banner (e.g., HTTP server version) from the target. The 'socket' module is used to manually craft the connection and payload, which is a low-level technique for service identification, not for scanning multiple ports or assessing vulnerabilities.
What should I do if I get this PT0-002 question wrong?
Review banner grabbing retrieves service version and type information., then practise related PT0-002 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Banner grabbing retrieves service version and type information.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.