During an external penetration test, a tester receives the following output from a tool: test.comptia.org info.comptia.org vpn.comptia.org exam.comptia.org Which of the following commands did the…

The correct answer is B. amass enum -passive -d comptia.org. Amass is a powerful OSINT tool used for subdomain enumeration. The command amass enum -passive -d comptia.org performs passive reconnaissance to discover subdomains like test.comptia.org, vpn.comptia.org, etc., without directly interacting with the target's

Submitted by mateo_ar· Mar 6, 2026Reconnaissance and enumeration

Question

During an external penetration test, a tester receives the following output from a tool:

test.comptia.org info.comptia.org vpn.comptia.org exam.comptia.org Which of the following commands did the tester most likely run to get these results?

Options

Anslookup -type=SOA comptia.org
Bamass enum -passive -d comptia.org
Cnmap -Pn -sV -vv -A comptia.org
Dshodan host comptia.org

How the community answered

(38 responses)

A
5% (2)
B
87% (33)
C
3% (1)
D
5% (2)

Explanation

Amass is a powerful OSINT tool used for subdomain enumeration. The command amass enum -passive -d comptia.org performs passive reconnaissance to discover subdomains like test.comptia.org, vpn.comptia.org, etc., without directly interacting with the target's

Topics

#subdomain enumeration#OSINT#reconnaissance tools#amass

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice