Worth 21% of the CompTIA PenTest+ (PT0-003) exam. CertClue has 64 questions on this objective.
Reconnaissance splits into two categories based on whether the tester ever actually touches the target's own systems, and the exam consistently tests whether a described technique crosses that line.
Exam tip. If the technique never sends anything to the target, it is passive, the instant a packet is sent to the target, it becomes active.
Free, with the answer and the reasoning. No account needed.
1. A tester examining Brindlewood Utilities' DNS finds a record type containing a string that publishes which mail servers are authorized to send email on behalf of the domain, helping receivers detect spoofed sender addresses. Which record holds this information?
SPF policies that list authorized sending mail servers are published inside TXT records. PTR maps an IP address to a hostname, NS lists authoritative nameservers, and CNAME is a canonical name alias, none of which convey sender authorization policy.
2. A tester preparing for an engagement against Cobalt Ridge Manufacturing reviews the company's public job postings, employee LinkedIn profiles, and press releases to identify technologies in use and potential targets for social engineering. This activity is best classified under which term?
OSINT is intelligence gathered from publicly available sources such as job postings, social media, and press releases. Vulnerability scanning and active enumeration involve direct technical interaction with target systems, and exploitation involves actively leveraging a discovered weakness, neither of which applies to reviewing public information.
The full CompTIA PenTest+ bank, the study notes behind these summaries, and a readiness score that tells you which objective to revise next. Free, no paid tier.
Take the free CompTIA PenTest+ practice test