mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: During a reconnaissance phase, a penetration…
During a reconnaissance phase, a penetration tester is using a tool to enumerate NetBIOS names on a target internal network. The tester issues the command 'nbtstat -A 192.168.1.100' on a Windows machine. What type of information is the tester most likely trying to obtain?
⚠ Common exam trap
It's easy for candidates to confuse `nbtstat -A` with `nbtstat -a` (which uses a NetBIOS name instead of an IP) or assume it returns OS details, when in fact it only returns the NetBIOS name table entries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NetBIOS name table including computer name, logged-in users, and domain
The `nbtstat -A` command queries the NetBIOS name table of a remote system using its IP address. This table contains the computer name, logged-in users, and domain/workgroup information, which are critical for identifying targets and potential trust relationships during internal reconnaissance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The operating system version and patch level
Why it's wrong here
nbtstat -A queries a remote host's NetBIOS name table, not its OS build. The name table is limited to 16-byte registered names and type codes, which describe services and user logins, not kernel versions or hotfixes. OS fingerprinting requires active TCP/IP stack interrogation or banner grabbing, such as nmap -O or a user-agent string, so patch level and version are out of scope for this utility.
- ✗
A list of currently open TCP ports on the remote system
Why it's wrong here
nbtstat -A is a NetBIOS over TCP/IP adapter status request to UDP/137 or the SMB session, and it returns only name registration records. It does not perform a port scan; enumerating open TCP ports requires a connect or SYN scan that actively probes a defined range of ports (e.g., nmap -p-). Consequently, the tool tells you which NetBIOS names are present but says nothing about listening services on ephemeral or non-NBT ports.
- ✗
The MAC address of the remote network interface
Why it's wrong here
The output of nbtstat -A does display a 'MAC Address =' line as a byproduct of the adapter status response, but the primary payload is the name table. That MAC field is a single low-level hardware identifier, while the correct answer describes the whole set of names—computer, users, domain—that constitute useful recon data. Therefore, focusing only on the MAC overlooks the actual enumeration value and mischaracterizes the command's purpose.
- ✓
The NetBIOS name table including computer name, logged-in users, and domain
Why this is correct
nbtstat -A with a remote IP performs an adapter status query, returning the NetBIOS name table that encodes the computer name as <00> UNIQUE, the logged-in user as <03> UNIQUE when the messenger service is active, and the domain or workgroup as <1C> or <00> GROUP entries. Decoding these suffix bytes yields identities that can be used for later phishing or credential attacks. This makes the name table—not OS details, port inventory, or a lone MAC—the authoritative output for a penetration tester during reconnaissance.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.