You are conducting a penetration test on a network with a strict firewall that only allows inbound traffic on ports 80 and 443. You need to identify internal services that are not directly accessible from the internet. Which technique would be MOST effective in discovering these internal services?

Perform a full TCP connect scan on all ports from the internet

Run a ping sweep to identify live hosts

Perform a DNS zone transfer to find internal hostnames

Use a web application vulnerability scanner to find SSRF vulnerabilities

CompTIAPenTest+

Domain 2Objective 2

Enumeration Techniques PT0-003 Practice Questions (Page 1)

Part of the Reconnaissance and enumeration domain, which accounts for 21% of the PT0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~14–23 in this domain), expect 4–6 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

9concepts

21%of the exam

Questions 1–5

1application · easy
You are conducting reconnaissance on a target organization. You have the domain name 'example.org' but no other information. You want to identify the IP addresses of the mail servers and web servers associated with this domain. Which DNS record types should you query to gather this information?
Select an answer first
2foundation · medium
A penetration tester connects to an open port and reads the initial response from the service. What is this technique called?
Select an answer first
3foundation · medium
During the reconnaissance phase of a penetration test, a tester wants to map the target organization's network by querying its DNS servers for hostnames and IP addresses. Which activity is the tester performing?
Select an answer first
4foundation · medium
Which tool is specifically designed to brute-force directories and files on a web server by using a wordlist?
Select an answer first
5expert · hard
You are conducting a penetration test on a network with a strict firewall that only allows inbound traffic on ports 80 and 443. You need to identify internal services that are not directly accessible from the internet. Which technique would be MOST effective in discovering these internal services?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PT0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “PT0-003” is a trademark of its owner, used for identification only.

Enumeration Techniques PT0-003 Practice Questions (Page 1)

Questions 1–5

You are conducting reconnaissance on a target organization. You have the domain name 'example.org' but no other information. You want to identify the IP addresses of the mail servers and web servers associated with this domain. Which DNS record types should you query to gather this information?

A penetration tester connects to an open port and reads the initial response from the service. What is this technique called?

During the reconnaissance phase of a penetration test, a tester wants to map the target organization's network by querying its DNS servers for hostnames and IP addresses. Which activity is the tester performing?

Which tool is specifically designed to brute-force directories and files on a web server by using a wordlist?

You are conducting a penetration test on a network with a strict firewall that only allows inbound traffic on ports 80 and 443. You need to identify internal services that are not directly accessible from the internet. Which technique would be MOST effective in discovering these internal services?

Keep studying — Reconnaissance and enumeration