PT0-002 Reconnaissance and Enumeration Practice Question
During an external penetration test, a tester needs to enumerate DNS records for a target domain to identify mail servers and potential subdomains. The tester has no credentials and wants to use a tool that queries DNS servers directly. Which tool is most appropriate for this task?
⚠ Common exam trap
Candidates often confuse general-purpose network or exploitation tools with specialized DNS enumeration utilities that can actively query name servers for records.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
dnsrecon
dnsrecon is purpose-built for DNS enumeration, supporting queries for MX, NS, and other record types as well as zone transfer attempts and subdomain brute-forcing. It operates without credentials and directly queries DNS servers. The other tools serve unrelated functions such as packet capture, password cracking, or SQL injection exploitation and cannot perform the required DNS record discovery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
sqlmap
Why it's wrong here
sqlmap automates SQL injection detection and exploitation against web applications. It does not perform DNS queries or enumerate DNS records, and it requires a web parameter or request to test. Using it here would be irrelevant to the DNS enumeration objective and would not identify mail servers or subdomains.
- ✓
dnsrecon
Why this is correct
dnsrecon is a dedicated DNS enumeration tool that can query name servers for records such as MX, NS, and A, and can attempt zone transfers and brute-force subdomains. It works without credentials and is designed for the exact task of DNS reconnaissance, making it the most appropriate choice for identifying mail servers and subdomains.
- ✗
Wireshark
Why it's wrong here
Wireshark is a packet capture and analysis tool, not an active DNS enumeration utility. It can observe DNS queries if traffic is already flowing, but it cannot generate queries to discover MX records or subdomains on demand. Using it for this scenario would require existing traffic and would not reliably enumerate the target's DNS records.
- ✗
John the Ripper
Why it's wrong here
John the Ripper is a password cracking tool used to recover credentials from captured hashes. It has no DNS enumeration capability and cannot query name servers for MX or subdomain records. Selecting it for DNS reconnaissance misunderstands its purpose and would not produce the required DNS data.
Visual reference
Go deeper
Related to this question
Learn chapter
Impacket Suite for Windows Exploitation
Key term
Exploitation
Exploitation is the act of using a vulnerability or weakness in a system, network, or application to gain unauthorized access, cause damage, or extract data.
Key term
Enumeration
Enumeration is the systematic process of extracting detailed information about a target system, such as user accounts, network shares, services, and configurations, used during the reconnaissance phase of a security assessment.
About these practice questions
This PT0-003 question is part of Courseiva's 777-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.