- A
Perform a full subnet ping sweep using Nmap
Why wrong: Ping sweeps send ICMP or TCP probes to many IPs, generating significant traffic and potentially triggering intrusion detection systems.
- B
Query the DNS service for SRV records of _ldap._tcp.dc._msdcs.domain.local
This DNS query directly retrieves the list of domain controllers. It is a normal DNS operation and unlikely to raise alerts.
- C
Use NetBIOS name resolution by sending broadcasts
Why wrong: NetBIOS broadcasts can be used to find domain controllers, but they generate broadcast traffic that may be monitored and can be less reliable.
- D
Enumerate SMB shares on all IP addresses in the subnet
Why wrong: Enumerating SMB shares involves connecting to each host, which generates considerable traffic and may be logged as reconnaissance activity.
Quick Answer
Querying the DNS service for SRV records of _ldap._tcp.dc._msdcs.domain.local is the correct choice because domain controllers automatically register these LDAP service records in DNS, making a single, standard lookup the most efficient and stealthy method to enumerate all domain controllers and their IP addresses. This technique generates minimal network traffic and avoids triggering security alerts, unlike noisy scans or brute-force enumeration. On the CompTIA PenTest+ PT0-002 exam, this tests your understanding of Active Directory discovery from a low-privileged position, where the key trap is assuming you need elevated credentials or aggressive scanning—when in fact, DNS SRV queries are anonymous and require no special rights. A helpful memory tip: think “DC discovery via DNS SRV” as the “silent directory” method, since it leverages the domain’s own infrastructure without raising alarms.
PT0-002 Practice Question: Information Gathering and Vulnerability Scanning
This PT0-002 practice question tests your understanding of information gathering and vulnerability scanning. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: active Directory uses DNS SRV records to locate services.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A penetration tester is performing internal reconnaissance on a Windows Active Directory environment. The tester has a low-privileged domain user account. Which of the following techniques is most likely to help identify all domain controllers and their IP addresses without generating excessive network traffic or alerts?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue:
"most likely"Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Query the DNS service for SRV records of _ldap._tcp.dc._msdcs.domain.local
Option B is correct because querying DNS for SRV records of _ldap._tcp.dc._msdcs.domain.local is a standard, low-noise method to discover all domain controllers in an Active Directory environment. This query leverages the automatic registration of LDAP service records by domain controllers, requiring only a single DNS lookup rather than sweeping the network, thus avoiding excessive traffic and typical security alerts.
Key principle: Active Directory uses DNS SRV records to locate services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perform a full subnet ping sweep using Nmap
- ✓
Query the DNS service for SRV records of _ldap._tcp.dc._msdcs.domain.local
Why this is correct
This DNS query directly retrieves the list of domain controllers. It is a normal DNS operation and unlikely to raise alerts.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Active Directory uses DNS SRV records to locate services.
- ✗
Use NetBIOS name resolution by sending broadcasts
Why it's wrong here
NetBIOS broadcasts can be used to find domain controllers, but they generate broadcast traffic that may be monitored and can be less reliable.
- ✗
Enumerate SMB shares on all IP addresses in the subnet
Why it's wrong here
Enumerating SMB shares involves connecting to each host, which generates considerable traffic and may be logged as reconnaissance activity.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often default to active scanning techniques like Nmap ping sweeps (Option A) because they are familiar, overlooking that DNS SRV record queries are a passive, targeted, and far more efficient method for discovering domain controllers in an Active Directory environment.
Detailed technical explanation
How to think about this question
Active Directory domain controllers automatically register SRV records in DNS under the _msdcs subdomain, specifically _ldap._tcp.dc._msdcs.<domain> for LDAP over TCP. Using tools like nslookup or dnsquery to retrieve these records returns the hostnames and IP addresses of all domain controllers, even across different sites, without generating any network probes beyond a single DNS query. In real-world engagements, this technique is stealthy because DNS queries are often considered normal traffic and are rarely monitored for reconnaissance.
KKey Concepts to Remember
- Active Directory uses DNS SRV records to locate services.
- SRV records like `_ldap._tcp.dc._msdcs` point to domain controllers.
- DNS queries are normal network traffic and low-alert risk.
- Low-privileged users can perform DNS SRV record lookups.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Active Directory uses DNS SRV records to locate services.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Active Directory uses DNS SRV records to locate services. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
What to study next
Got this wrong? Here's your next step.
Review active Directory uses DNS SRV records to locate services., then practise related PT0-002 questions on the same topic to reinforce the concept.
- →
Information Gathering and Vulnerability Scanning — study guide chapter
Learn the concepts, then practise the questions
- →
Information Gathering and Vulnerability Scanning practice questions
Targeted practice on this topic area only
- →
All PT0-002 questions
509 questions across all exam domains
- →
CompTIA PenTest+ PT0-002 study guide
Full concept coverage aligned to exam objectives
- →
PT0-002 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related PT0-002 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Planning and Scoping practice questions
Practise PT0-002 questions linked to Planning and Scoping.
Information Gathering and Vulnerability Scanning practice questions
Practise PT0-002 questions linked to Information Gathering and Vulnerability Scanning.
Attacks and Exploits practice questions
Practise PT0-002 questions linked to Attacks and Exploits.
Reporting and Communication practice questions
Practise PT0-002 questions linked to Reporting and Communication.
Tools and Code Analysis practice questions
Practise PT0-002 questions linked to Tools and Code Analysis.
PT0-002 fundamentals practice questions
Practise PT0-002 questions linked to PT0-002 fundamentals.
PT0-002 scenario practice questions
Practise PT0-002 questions linked to PT0-002 scenario.
PT0-002 troubleshooting practice questions
Practise PT0-002 questions linked to PT0-002 troubleshooting.
Practice this exam
Start a free PT0-002 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this PT0-002 question test?
Information Gathering and Vulnerability Scanning — This question tests Information Gathering and Vulnerability Scanning — Active Directory uses DNS SRV records to locate services..
What is the correct answer to this question?
The correct answer is: Query the DNS service for SRV records of _ldap._tcp.dc._msdcs.domain.local — Option B is correct because querying DNS for SRV records of _ldap._tcp.dc._msdcs.domain.local is a standard, low-noise method to discover all domain controllers in an Active Directory environment. This query leverages the automatic registration of LDAP service records by domain controllers, requiring only a single DNS lookup rather than sweeping the network, thus avoiding excessive traffic and typical security alerts.
What should I do if I get this PT0-002 question wrong?
Review active Directory uses DNS SRV records to locate services., then practise related PT0-002 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Active Directory uses DNS SRV records to locate services.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.