What is the best way to practise Reconnaissance and Enumeration questions?

Start with a short focused session to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.

Can I practise only Reconnaissance and Enumeration questions?

Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.

PT0-003 · domain

Reconnaissance and Enumeration

Q: How many Reconnaissance and Enumeration practice questions does Courseiva have?

Courseiva has 4 Reconnaissance and Enumeration practice questions for the PT0-003 exam.

Practise CompTIA PenTest+ (PT0-003) Reconnaissance and Enumeration practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

4 questions1 easy2 medium1 hard

Start practice test All CompTIA PenTest+ (PT0-003) questions →

Focused practice

Practice Reconnaissance and Enumeration questions

Scored sessions drawing only from this domain — pick a length below.

What this domain covers

What to know about Reconnaissance and Enumeration

Reconnaissance and Enumeration questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Reconnaissance and Enumeration exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Question index

All Reconnaissance and Enumeration questions (4)

Click any question to see the full explanation, or start a practice session above.

Which tool is specifically designed for scanning WordPress websites to detect vulnerabilities, such as outdated plugins, themes, and weak passwords?

Easy 2

A penetration tester is performing passive reconnaissance on a target organization. Which of the following tools would be BEST suited to gather information about the organization's domain names, email addresses, and subdomains from publicly available sources without directly interacting with the target's systems?

Medium 3

During a penetration test, you want to perform a stealthy port scan that minimizes the chance of being logged by the target. Which Nmap option should you use?

Medium 4

During a penetration test, you want to discover API endpoints and hidden parameters in a web application. Which tool combination is most effective for this task?

Hard

Other domains

All PT0-003 exam domains

Post-exploitation and Lateral Movement Practice →

Vulnerability Discovery and Analysis Practice →

Engagement Management Practice →

Reconnaissance and Enumeration(current)

Attacks and Exploits Practice →

Frequently asked questions

What does the Reconnaissance and Enumeration domain cover on the PT0-003 exam?: Reconnaissance and Enumeration questions test whether you can apply the concept in context, not just recognise a definition.
How many questions are in this domain?: This page lists all 4 Reconnaissance and Enumeration questions in the PT0-003 question bank. The actual exam draws from this domain proportionally to its weighting in the official exam blueprint.
What is the best way to practise this domain?: Start with a short focused session (10 questions) to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.
Can I practise only Reconnaissance and Enumeration questions?: Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.

Study guide

Read about Reconnaissance and Enumeration

The PT0-003 study guide for this domain covers everything tested on the real exam.

Read now

Exam simulator

Take a full practice exam

75–120 questions · 120-min timer · PBQs first · Pearson VUE–style score (300–1000)

Start exam

Domain-focused practice

Each domain maps to a weighted exam section. Focus on the domain where you are weakest.

Post-exploitation and Lateral Movement Vulnerability Discovery and Analysis Engagement Management Reconnaissance and Enumeration Attacks and Exploits

Practice by scenario

Practise one question format at a time: exhibits, multi-select, drag-and-drop, troubleshooting.

Browse scenarios

Topic-level practice

Each topic page collects the questions that test one concept, plus the theory behind it.

Post-exploitation and Lateral Movement practice questions Vulnerability Discovery and Analysis practice questions Engagement Management practice questions Reconnaissance and Enumeration practice questions Attacks and Exploits practice questions PT0-003 fundamentals practice questions PT0-003 scenario practice questions PT0-003 troubleshooting practice questions

Common exam traps

•Answering from memory before reading the full scenario.
•Missing a constraint such as cost, availability, security, scope or command context.
•Choosing a broad answer when the question asks for the most specific fix.
•Ignoring why the wrong options are tempting.

Where to go next

Practice Reconnaissance and Enumeration questions PT0-003 exam guide Study guide All PT0-003 domains All PT0-003 questions

Practice 25 questions