During a penetration test, a tester discovers that port 443 is open on a target server. The tester wants to identify the specific web server software and version. Which tool or technique would be most appropriate?

Perform a DNS zone transfer to enumerate subdomains

Use Nmap with the -sV flag to perform service version detection

Run a full TCP connect scan on all 65535 ports

Use Wireshark to capture traffic on the local network

A penetration tester is performing service enumeration on a target and finds that port 443 is open. The tester wants to identify the web application and its version, but the application is behind a load balancer that strips the Server header. Which technique would be most effective?

Run a DNS brute-force to find virtual hosts

Perform a full TCP connect scan on all ports

Use Wireshark to capture traffic to the load balancer

Send a malformed HTTP request and analyze the error response

A penetration tester is conducting passive reconnaissance on a high-profile target. The tester needs to map the organization's external attack surface, including subdomains, IP ranges, and technologies, without alerting the target. The tester has access to certificate transparency logs, search engines, and public DNS records. Which approach would provide the most comprehensive passive footprint?

Perform a zone transfer from the target's authoritative DNS server

Use Shodan to search for the target's domain and identify all exposed services

Run a brute-force subdomain enumeration tool against the target's domain

Query certificate transparency logs for all subdomains and then use passive DNS databases to resolve them to IP addresses

A penetration tester has captured a pcap file from a target network. The tester wants to identify all HTTP requests that contain the string 'admin' in the URI. Which Wireshark display filter would accomplish this?

http.request.uri contains "admin"

tcp.port == 80 and frame contains "admin"

http.response.code == 200 and http contains "admin"

A penetration tester is performing passive reconnaissance on a target organization. The tester wants to identify employee email addresses and potential technology stack without sending any packets directly to the target's infrastructure. Which technique would be most appropriate?

Query the target's DNS servers for TXT records and perform a zone transfer

Use a search engine to find cached versions of the target's website and job postings

Run a port scan on the target's public IP range

Connect to the target's SMTP server and issue VRFY commands

CompTIAPenTest+

Domain 2Objective 1

Active and Passive Reconnaissance PT0-003 Practice Questions (Page 1)

Part of the Reconnaissance and enumeration domain, which accounts for 21% of the PT0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~14–23 in this domain), expect 4–6 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

6concepts

21%of the exam

Questions 1–5

1application · medium
During a penetration test, a tester discovers that port 443 is open on a target server. The tester wants to identify the specific web server software and version. Which tool or technique would be most appropriate?
Select an answer first
2expert · hard
A penetration tester is performing service enumeration on a target and finds that port 443 is open. The tester wants to identify the web application and its version, but the application is behind a load balancer that strips the Server header. Which technique would be most effective?
Select an answer first
3expert · hard
A penetration tester is conducting passive reconnaissance on a high-profile target. The tester needs to map the organization's external attack surface, including subdomains, IP ranges, and technologies, without alerting the target. The tester has access to certificate transparency logs, search engines, and public DNS records. Which approach would provide the most comprehensive passive footprint?
Select an answer first
4application · medium
A penetration tester has captured a pcap file from a target network. The tester wants to identify all HTTP requests that contain the string 'admin' in the URI. Which Wireshark display filter would accomplish this?
Select an answer first
5application · medium
A penetration tester is performing passive reconnaissance on a target organization. The tester wants to identify employee email addresses and potential technology stack without sending any packets directly to the target's infrastructure. Which technique would be most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PT0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “PT0-003” is a trademark of its owner, used for identification only.