The correct answer is using search engines and public certificate transparency logs because these methods enable subdomain discovery through third-party aggregated data rather than direct queries to the target’s authoritative DNS servers. This is a core passive reconnaissance technique that relies on historical DNS records and TLS certificate metadata collected by platforms like Google and crt.sh, allowing a tester to map subdomains without generating any network traffic toward the target. On the CompTIA PenTest+ PT0-002 exam, this question tests your ability to distinguish passive from active reconnaissance, often appearing in scenario-based items where the key constraint is avoiding direct interaction with the target’s infrastructure. A common trap is choosing DNS zone transfers or brute-force enumeration, which are active techniques that send queries directly to the target’s servers. Remember the memory tip: “Passive means public records, not pings.”
PT0-002 Practice Question: Information Gathering and Vulnerability Scanning
This PT0-002 practice question tests your understanding of information gathering and vulnerability scanning. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
During the reconnaissance phase, a penetration tester wants to identify subdomains of a target domain without making direct requests to the target's own DNS servers. Which technique would be BEST for this purpose?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Using search engines and public certificate transparency logs
Option C is correct because search engines (e.g., Google dorking) and public certificate transparency logs (e.g., crt.sh) allow a tester to discover subdomains by querying aggregated historical DNS and TLS certificate data, without sending any queries to the target's authoritative DNS servers. This passive reconnaissance technique avoids alerting the target's infrastructure and complies with the requirement of no direct requests to the target's DNS servers.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Using the 'nslookup' command interactively
Why it's wrong here
nslookup directly queries the target's DNS servers, making it an active reconnaissance technique.
✗
Performing a zone transfer
Why it's wrong here
Zone transfers are active and rarely succeed due to security restrictions; also they directly interact with the target.
✓
Using search engines and public certificate transparency logs
Why this is correct
These sources aggregate data from external observations and do not require contacting the target, thus are passive.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Using the 'host' command
Why it's wrong here
The host command performs direct DNS lookups against the target's servers, so it is active.
Common exam traps
Common exam trap: answer the scenario, not the keyword
CompTIA often tests the distinction between active and passive reconnaissance, and the trap here is that candidates may choose zone transfer (Option B) because it is a well-known DNS enumeration technique, but they overlook that it requires direct contact with the target's DNS server and is typically blocked, whereas certificate transparency logs provide a passive alternative that avoids direct interaction.
Trap categories for this question
Command / output trap
The host command performs direct DNS lookups against the target's servers, so it is active.
Detailed technical explanation
How to think about this question
Certificate Transparency (CT) logs, defined in RFC 6962, require Certificate Authorities (CAs) to submit all issued TLS certificates to public logs; these logs contain Subject Alternative Names (SANs) and Common Names (CNs) that often list subdomains. Tools like crt.sh aggregate these logs, enabling passive subdomain enumeration by querying the log index rather than the target's DNS infrastructure, which is especially useful for identifying subdomains that may not be publicly resolvable via standard DNS.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A developer is choosing between AES-256 (symmetric) and RSA-2048 (asymmetric) for encrypting a large file that will be sent to a partner. Symmetric encryption is fast but requires key exchange; asymmetric is slower but solves the key distribution problem. A hybrid approach — encrypt the file with AES, encrypt the AES key with RSA — is standard. Questions like this test whether you understand when each approach applies.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this PT0-002 question in full detail.
Information Gathering and Vulnerability Scanning — This question tests Information Gathering and Vulnerability Scanning — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Using search engines and public certificate transparency logs — Option C is correct because search engines (e.g., Google dorking) and public certificate transparency logs (e.g., crt.sh) allow a tester to discover subdomains by querying aggregated historical DNS and TLS certificate data, without sending any queries to the target's authoritative DNS servers. This passive reconnaissance technique avoids alerting the target's infrastructure and complies with the requirement of no direct requests to the target's DNS servers.
What should I do if I get this PT0-002 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During the reconnaissance phase, a penetration tester wants to map out the target's DNS infrastructure without directly interacting with the target's servers. Which of the following techniques BEST achieves this?
easy
A.Performing a DNS zone transfer
✓ B.Querying publicly available DNS records
C.Using Nmap to scan for DNS servers
D.Sending crafted DNS queries to the target's DNS server
Why B: Option B is correct because querying publicly available DNS records (e.g., via passive DNS, WHOIS, or DNS dumpster) allows the tester to gather DNS information without any direct interaction with the target's servers. This technique relies on third-party databases and cached records, avoiding any packets sent to the target, which is essential for stealth during reconnaissance. It aligns with passive information gathering, as defined in the PT0-002 objectives.
Variation 2. Which of the following tools is primarily used for enumerating subdomains via search engine queries?
easy
A.Metasploit
B.Netcat
✓ C.theHarvester
D.Nmap
Why C: theHarvester is specifically designed to gather emails, subdomains, IPs, and URLs from public sources, including search engines like Google, Bing, and Yahoo. It leverages search engine APIs and scraping techniques to enumerate subdomains without directly interacting with the target infrastructure, making it the correct tool for this task.
Variation 3. Which of the following tools would a penetration tester most likely use to perform passive reconnaissance on a target domain?
easy
A.Wireshark
B.Nmap
C.Metasploit
✓ D.theHarvester
Why D: theHarvester is a passive reconnaissance tool that gathers information from public sources such as search engines, PGP key servers, and the Shodan API without directly interacting with the target domain. It collects email addresses, subdomains, IPs, and employee names using OSINT (Open Source Intelligence) techniques, making it ideal for passive information gathering.
Variation 4. A penetration tester is performing information gathering on a large organization that uses split-DNS architecture, with internal and external DNS servers. The tester wants to discover internal hostnames without performing any active scans that might trigger detection controls. The tester has obtained the organization's domain name from public WHOIS records. Which of the following techniques would be MOST effective in discovering internal hostnames passively?
hard
A.Run a DNS brute force attack using a common subdomain wordlist
B.Use search engines with site:domain.com to find cached pages with internal references
✓ C.Query the organization's TLS certificate transparency logs for subdomains
D.Perform a DNS zone transfer attempt from the external DNS server
Why C: Option C is correct because certificate transparency logs often list all subdomains with publicly trusted SSL certificates, including internal ones. Option A (zone transfer) is active and likely to be blocked. Option B (search engines) may find some hostnames but not comprehensive. Option D (DNS brute force) is active and noisy.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.