nerdexam
EC-Council

312-50V12 · Question #243

A penetration tester is tasked with gathering information about the subdomains of a target organization's website. The tester needs a versatile and efficient solution for the task. Which of the…

The correct answer is B. Employing a tool like Sublist3r, which is designed to enumerate the subdomains of websites using. The most effective method for a penetration tester to gather information about subdomains is to employ specialized tools designed for subdomain enumeration, as they efficiently discover associated subdomains.

Submitted by certguy· Mar 4, 2026Reconnaissance Techniques

Question

A penetration tester is tasked with gathering information about the subdomains of a target organization's website. The tester needs a versatile and efficient solution for the task. Which of the following options would be the most effective method to accomplish this goal?

Options

  • AAnalyzing LinkedIn profiles to find employees of the target company and their job titles
  • BEmploying a tool like Sublist3r, which is designed to enumerate the subdomains of websites using
  • CUsing a people search service, such as Spokeo or Intelius, to gather information about the
  • DUtilizing the Harvester tool to extract email addresses related to the target domain using a search

How the community answered

(63 responses)
  • A
    2% (1)
  • B
    94% (59)
  • C
    2% (1)
  • D
    3% (2)

Why each option

The most effective method for a penetration tester to gather information about subdomains is to employ specialized tools designed for subdomain enumeration, as they efficiently discover associated subdomains.

AAnalyzing LinkedIn profiles to find employees of the target company and their job titles

Analyzing LinkedIn profiles is a technique for gathering information about personnel (OSINT), not for technical subdomain discovery.

BEmploying a tool like Sublist3r, which is designed to enumerate the subdomains of websites usingCorrect

Sublist3r is a dedicated and versatile open-source tool specifically designed for subdomain enumeration. It queries multiple search engines, DNS services, and passive online sources to identify subdomains, directly fulfilling the penetration tester's goal of gathering subdomain information efficiently.

CUsing a people search service, such as Spokeo or Intelius, to gather information about the

Using people search services like Spokeo or Intelius is for gathering personal information about individuals, not for enumerating technical subdomains of an organization.

DUtilizing the Harvester tool to extract email addresses related to the target domain using a search

While the Harvester is an OSINT tool, its primary described function in this choice is extracting email addresses, which is not the direct goal of enumerating subdomains, even if it might incidentally find some.

Concept tested: Subdomain enumeration tools and techniques

Source: https://owasp.org/www-project-web-security-testing-guide/v42/4-Information_Gathering/WSTG-INFO-04-Enumerate_Subdomains_and_Host_Names

Topics

#Subdomain enumeration#OSINT tools#Sublist3r#Footprinting

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V12 Practice