A penetration tester attempts a DNS zone transfer against a target domain. What is the primary goal of this technique?

To perform a reverse DNS lookup on all IP addresses

To poison the DNS cache of the target's resolver

To identify the operating system of the DNS server

To obtain a complete copy of the DNS zone records for the domain

You are performing reconnaissance on a target network and have obtained a list of IP addresses from a prior port scan. You want to identify which of these IPs host web servers and what domains they are associated with, without making direct HTTP requests that might trigger alerts. Which technique is most appropriate for this task?

Use 'nmap -sV' to grab banners from each IP

Send an HTTP GET request to each IP with the 'Host: example.com' header

Run a full TCP connect scan on port 80 for all IPs

Perform a reverse DNS lookup on each IP address using 'dig -x'

You are testing a web application that uses a content management system (CMS). You have discovered that the CMS is outdated and has known vulnerabilities. You want to find the admin login page to attempt a brute-force attack. The admin page is not linked from the main site. Which technique is MOST likely to find the admin page?

Perform a DNS zone transfer to find the admin subdomain

Check the robots.txt file for the admin path

Use a directory brute-forcer with a wordlist specific to the CMS

Use Nmap to scan for open ports on the server

During a penetration test, you have discovered a web server that is hosting a file named 'config.php.bak'. You want to determine if this file contains sensitive information. Which of the following is the most appropriate action?

Run a DNS reverse lookup on the server IP

Perform a port scan on the server

Use Nmap to check the file's permissions

Request the file using a web browser or curl to view its contents

CompTIAPenTest+

Domain 2Objective 2

Enumeration Techniques PT0-003 Practice Questions (Page 4)

Part of the Reconnaissance and enumeration domain, which accounts for 21% of the PT0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~14–23 in this domain), expect 4–6 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

9concepts

21%of the exam

Questions 16–20

16foundation · medium
A penetration tester attempts a DNS zone transfer against a target domain. What is the primary goal of this technique?
Select an answer first
17foundation · medium
A penetration tester has a list of IP addresses and wants to find which hostnames are associated with them. Which DNS technique should the tester use?
Select an answer first
18application · medium
You are performing reconnaissance on a target network and have obtained a list of IP addresses from a prior port scan. You want to identify which of these IPs host web servers and what domains they are associated with, without making direct HTTP requests that might trigger alerts. Which technique is most appropriate for this task?
Select an answer first
19expert · medium
You are testing a web application that uses a content management system (CMS). You have discovered that the CMS is outdated and has known vulnerabilities. You want to find the admin login page to attempt a brute-force attack. The admin page is not linked from the main site. Which technique is MOST likely to find the admin page?
Select an answer first
20application · easy
During a penetration test, you have discovered a web server that is hosting a file named 'config.php.bak'. You want to determine if this file contains sensitive information. Which of the following is the most appropriate action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PT0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “PT0-003” is a trademark of its owner, used for identification only.

Enumeration Techniques PT0-003 Practice Questions (Page 4)

Questions 16–20

A penetration tester attempts a DNS zone transfer against a target domain. What is the primary goal of this technique?

A penetration tester has a list of IP addresses and wants to find which hostnames are associated with them. Which DNS technique should the tester use?

During a penetration test, you have discovered a web server that is hosting a file named 'config.php.bak'. You want to determine if this file contains sensitive information. Which of the following is the most appropriate action?

Keep studying — Reconnaissance and enumeration