Which of the following is an example of service enumeration?

Using a ping to check if a host is up

Using traceroute to map the network path

Using Nmap's -sV flag to determine the version of an SSH service

Using whois to look up domain registration information

A penetration tester is building a profile of a target organization using only open-source intelligence. The tester wants to identify the organization's physical locations and key personnel. Which combination of OSINT sources would provide the most comprehensive information?

LinkedIn, Google Maps, and the organization's annual report

The target's firewall logs and IDS alerts

A penetration tester is conducting passive reconnaissance on a target organization. The tester wants to identify the organization's cloud service provider and the regions where they host their infrastructure, without directly querying the target's systems. Which OSINT technique would be most effective?

Perform a DNS zone transfer from the target's authoritative server

Analyze the target's SSL/TLS certificates for issuer and SAN entries

Use theHarvester to search for email addresses

Use Nmap to scan the target's IP range for cloud provider fingerprints

CompTIAPenTest+

Domain 2Objective 1

Active and Passive Reconnaissance PT0-003 Practice Questions (Page 5)

Part of the Reconnaissance and enumeration domain, which accounts for 21% of the PT0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~14–23 in this domain), expect 4–6 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

6concepts

21%of the exam

Questions 21–25

21foundation · easy
After identifying that a target host has port 80 open, a penetration tester wants to determine the specific web server software and version running. Which technique is most appropriate?
Select an answer first
22foundation · easy
A penetration tester wants to capture network traffic on a switched network segment to analyze the data being transmitted. Which tool is specifically designed for network sniffing?
Select an answer first
23foundation · easy
Which of the following is an example of service enumeration?
Select an answer first
24application · medium
A penetration tester is building a profile of a target organization using only open-source intelligence. The tester wants to identify the organization's physical locations and key personnel. Which combination of OSINT sources would provide the most comprehensive information?
Select an answer first
25expert · hard
A penetration tester is conducting passive reconnaissance on a target organization. The tester wants to identify the organization's cloud service provider and the regions where they host their infrastructure, without directly querying the target's systems. Which OSINT technique would be most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PT0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “PT0-003” is a trademark of its owner, used for identification only.

Active and Passive Reconnaissance PT0-003 Practice Questions (Page 5)

Questions 21–25

After identifying that a target host has port 80 open, a penetration tester wants to determine the specific web server software and version running. Which technique is most appropriate?

A penetration tester wants to capture network traffic on a switched network segment to analyze the data being transmitted. Which tool is specifically designed for network sniffing?

Which of the following is an example of service enumeration?

A penetration tester is building a profile of a target organization using only open-source intelligence. The tester wants to identify the organization's physical locations and key personnel. Which combination of OSINT sources would provide the most comprehensive information?

Keep studying — Reconnaissance and enumeration