CompTIA PenTest+ (PT0-002) — Question 318

A penetration tester is gathering information about a target company for a penetration test in order to tailor the type of attacks. However, the tester is worried about sending packets to the company that could tip off the SOC before the attacks begin. Which of the following sources should the tester use to achieve this objective?

Answer options

• A. Nmap
• B. Shodan
• C. CeWL
• D. Nessus

Correct answer: B

Explanation

Shodan is a search engine that allows users to find devices connected to the internet without actively probing them, minimizing the risk of detection by the SOC. In contrast, Nmap and Nessus involve active scanning which could alert the SOC, while CeWL is a tool for generating wordlists and is not designed for reconnaissance in the same way.