Which Reconnaissance Activities Have Minimal Detection Risk?

PT0-002 By islever Editorial Last updated

Short answer

AC Open-source research Traffic sniffing

Question

A penetration tester wants to perform reconnaissance without being detected. Which of the following activities have a minimal chance of detection? (Choose two.)
  1. Open-source research Correct Answer
  2. A ping sweep
  3. Traffic sniffing Correct Answer
  4. Port knocking
  5. A vulnerability scan

Key Takeaways

The question tests your ability to distinguish passive from active reconnaissance; the trap is mistaking port knocking as passive when it actually sends connection attempts that can be logged and detected.

For the CompTIA PT0-002 exam, passive reconnaissance techniques such as open-source research and traffic sniffing minimize detection, while active techniques like ping sweeps and vulnerability scans are easily detected. Community consensus for this question strongly favors options A and C.

Common mistake: The most common wrong answer is choosing D (port knocking) instead of C (traffic sniffing), because port knocking seems stealthy and covert; however, it is still an active interaction with the target that generates packets, making it detectable, whereas passive traffic sniffing generates no network traffic.

Expert Analysis

Why the Answer Is Correct

Open-source research (A) is a passive technique that relies on publicly available information, requiring no direct interaction with the target, so it carries minimal detection risk. Traffic sniffing (C) is also passive when performed on a network segment where the tester can observe packets without injecting data; in its passive form, it does not generate traffic that would alert the target. Together these are the two clearly passive options listed, matching the community consensus in comment [3] that "only two that are passive."

Why the Other Options Are Wrong

Ping sweep (B) and vulnerability scan (E) are active scanning techniques that send probes to target systems, generating logs and alerts and making them easy to detect. Port knocking (D) is not passive either; as comment [1] notes, if the tester does not know the exact sequence, guessing creates a lot of noise, and even a valid knock produces connection attempts that can be monitored. Port knocking may appear stealthy because it is used for covert access, but it still involves direct network interaction and therefore has a higher chance of detection than passive sniffing or OSINT.

Community Comment Notes

The majority of voters (78) support AC, emphasizing that passivity is the key criterion. A minority (22) chose AD, likely confusing the intent of port knocking with passive reconnaissance. Comment [2] appears to argue for open-source research and port knocking, but its reasoning is incomplete, while the more technically precise comment [1] explains why port knocking fails the "minimal detection" test. Overall, the community consensus aligns with the suggested answer and reinforces the importance of recognizing active vs. passive techniques.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When asked about detection risk, classify each activity as passive or active. Passive activities such as OSINT and passive sniffing are generally undetectable, while anything that sends packets or directly interacts with the target—ping sweeps, port knocking, vulnerability scans—carries a higher detection risk. Remember that 'traffic sniffing' is passive only when you are not actively manipulating the network.

Community Votes

AC
78%
AD
22%

78% of anonymous learners picked answer AC. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Jay39 👍 2
    To perform reconnaissance with minimal chance of detection, the following activities are generally less likely to be detected: A. Open-source research Open-source research involves gathering information from publicly available sources such as websites, social media, and public databases. This activity is passive and does not involve direct interaction with the target systems, making it very difficult to detect. D. Port knocking Port knocking is a technique used to gain access to a system by sending a sequence of network packets to closed ports, which can be configured to open a port for access. When used for reconnaissance, it can be configured to have minimal visibility and is less likely to be detected if the knocking sequence is well-crafted and not too frequent.
  2. kinny4000 👍 2
    Port knocking can certainly be detected, if you don't have the right combination of ports to knock you will make a lot of noise trying to guess it. The question doesn't state that we know the sequence, even if we did, this is not passive.
  3. PMann 👍 5
    Only two that are passive.
  4. Obiwan123 👍 4
    AD - Anthony Davis

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Which Post-Report Activity Prevents CISO Disputing Finding Validity?

S-grade

How should penetration testers prioritize findings in a report?

S-grade

Which agreement did a pen tester breach by requesting a CVE without authorization?

S-grade

Which Tool Best Detects Vulnerabilities on a Database Server?

S-grade

← Back to PT0-002 Study Guide