PT0-003 Question #32: Real Exam Question with Answer & Explanation

The correct answer is D: cat wordlist.txt | xargs -n 1 -I 'X' host X.mydomain.com. Using dig with a wordlist to identify subdomains is an effective method for subdomain enumeration. The command cat wordlist.txt | xargs -n 1 -I 'X' dig X.mydomain.com reads each line from wordlist.txt and performs a DNS lookup for each potential subdomain.

Submitted by parkjh· Mar 6, 2026Reconnaissance and enumeration

Question

A penetration tester completed OSINT work and needs to identify common subdomains for mydomain.com. Which of the following is the best command for the tester to use?

Options

Anslookup mydomain.com >> /path/to/results.txt
Bcrunch 1 2 | xargs -n 1 -I 'X' nslookup X.mydomain.com
Dcat wordlist.txt | xargs -n 1 -I 'X' host X.mydomain.com

Explanation

Using dig with a wordlist to identify subdomains is an effective method for subdomain enumeration. The command cat wordlist.txt | xargs -n 1 -I 'X' dig X.mydomain.com reads each line from wordlist.txt and performs a DNS lookup for each potential subdomain.

Topics

#subdomain enumeration#OSINT#reconnaissance tools#DNS lookup

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice Browse All PT0-003 Questions