- A
Running Nmap with the -A flag against the target's public IP range
Why wrong: Nmap is an active scanning tool that sends packets to the target networks. This would generate traffic and is not passive.
- B
Using theHarvester to search for email addresses and subdomains
Why wrong: theHarvester gathers email addresses and subdomains from public sources, but it primarily focuses on enumeration, not technology stack detection.
- C
Querying public records with BuiltWith
BuiltWith uses public data and DNS records to profile the technologies used by a website, including web servers, frameworks, and analytics tools, all without sending any traffic to the target.
- D
Performing a DNS zone transfer
Why wrong: DNS zone transfer is an active reconnaissance technique that may or may not succeed. It also directly queries the target's DNS server, creating network traffic.
Quick Answer
The answer is querying public records with BuiltWith, as it enables passive technology stack identification without any direct interaction with the target systems. BuiltWith works by aggregating data from public web sources, DNS records, and cached information to reveal a target’s web server software (such as Apache or Nginx) and frameworks (like React or Django), making it a purely passive reconnaissance tool that sends no packets to the target. On the CompTIA PenTest+ PT0-002 exam, this question tests your ability to distinguish passive from active techniques, with a common trap being to confuse BuiltWith with active scanners like Nmap or Wappalyzer browser extensions that require live page loads. Remember the memory tip: “BuiltWith builds its report from the outside in—no packets, no pings, just public records.”
PT0-002 Practice Question: Information Gathering and Vulnerability Scanning
This PT0-002 practice question tests your understanding of information gathering and vulnerability scanning. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: builtWith analyzes public web data to identify technologies.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A penetration tester is performing passive reconnaissance on a target organization. The tester wants to gather information about the target's technology stack, including web server software and frameworks, without directly interacting with the target systems. Which technique is most effective?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Querying public records with BuiltWith
BuiltWith is a passive reconnaissance tool that queries public web data and DNS records to identify a target's technology stack, such as web server software (e.g., Apache, Nginx) and frameworks (e.g., React, Django), without sending any packets to the target's systems. This makes it ideal for passive information gathering, as it relies on third-party databases and cached information rather than direct interaction.
Key principle: BuiltWith analyzes public web data to identify technologies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Running Nmap with the -A flag against the target's public IP range
Why it's wrong here
Nmap is an active scanning tool that sends packets to the target networks. This would generate traffic and is not passive.
- ✗
Using theHarvester to search for email addresses and subdomains
Why it's wrong here
theHarvester gathers email addresses and subdomains from public sources, but it primarily focuses on enumeration, not technology stack detection.
- ✓
Querying public records with BuiltWith
Why this is correct
BuiltWith uses public data and DNS records to profile the technologies used by a website, including web servers, frameworks, and analytics tools, all without sending any traffic to the target.
Related concept
BuiltWith analyzes public web data to identify technologies.
- ✗
Performing a DNS zone transfer
Why it's wrong here
DNS zone transfer is an active reconnaissance technique that may or may not succeed. It also directly queries the target's DNS server, creating network traffic.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse passive reconnaissance with low-interaction active tools like Nmap's -A flag, failing to recognize that any direct network probing constitutes active reconnaissance, even if it's just a single scan.
Detailed technical explanation
How to think about this question
BuiltWith aggregates data from multiple sources, including WHOIS records, HTTP headers from archived pages, and JavaScript libraries detected in cached content, to build a profile of a target's technology stack. In a real-world scenario, a tester might use BuiltWith to discover that a target uses a specific version of a CMS like WordPress, which then informs the search for known vulnerabilities in that version without ever touching the target's network.
KKey Concepts to Remember
- BuiltWith analyzes public web data to identify technologies.
- It operates without sending traffic to the target.
- BuiltWith profiles web servers, CMS, frameworks, and analytics.
- It is a prime example of a passive reconnaissance tool.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
BuiltWith analyzes public web data to identify technologies.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. BuiltWith analyzes public web data to identify technologies. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
What to study next
Got this wrong? Here's your next step.
Review builtWith analyzes public web data to identify technologies., then practise related PT0-002 questions on the same topic to reinforce the concept.
- →
Information Gathering and Vulnerability Scanning — study guide chapter
Learn the concepts, then practise the questions
- →
Information Gathering and Vulnerability Scanning practice questions
Targeted practice on this topic area only
- →
All PT0-002 questions
509 questions across all exam domains
- →
CompTIA PenTest+ PT0-002 study guide
Full concept coverage aligned to exam objectives
- →
PT0-002 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related PT0-002 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Planning and Scoping practice questions
Practise PT0-002 questions linked to Planning and Scoping.
Information Gathering and Vulnerability Scanning practice questions
Practise PT0-002 questions linked to Information Gathering and Vulnerability Scanning.
Attacks and Exploits practice questions
Practise PT0-002 questions linked to Attacks and Exploits.
Reporting and Communication practice questions
Practise PT0-002 questions linked to Reporting and Communication.
Tools and Code Analysis practice questions
Practise PT0-002 questions linked to Tools and Code Analysis.
PT0-002 fundamentals practice questions
Practise PT0-002 questions linked to PT0-002 fundamentals.
PT0-002 scenario practice questions
Practise PT0-002 questions linked to PT0-002 scenario.
PT0-002 troubleshooting practice questions
Practise PT0-002 questions linked to PT0-002 troubleshooting.
Practice this exam
Start a free PT0-002 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this PT0-002 question test?
Information Gathering and Vulnerability Scanning — This question tests Information Gathering and Vulnerability Scanning — BuiltWith analyzes public web data to identify technologies..
What is the correct answer to this question?
The correct answer is: Querying public records with BuiltWith — BuiltWith is a passive reconnaissance tool that queries public web data and DNS records to identify a target's technology stack, such as web server software (e.g., Apache, Nginx) and frameworks (e.g., React, Django), without sending any packets to the target's systems. This makes it ideal for passive information gathering, as it relies on third-party databases and cached information rather than direct interaction.
What should I do if I get this PT0-002 question wrong?
Review builtWith analyzes public web data to identify technologies., then practise related PT0-002 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
BuiltWith analyzes public web data to identify technologies.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.