Which Reconnaissance Activities Have Minimal Detection Risk?
A penetration tester wants to perform reconnaissance without being detected. Which of the following activities have a minimal chance of detection? (Choose two.)
Community Votes
78% of anonymous learners picked answer AC. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests your ability to distinguish passive from active reconnaissance; the trap is mistaking port knocking as passive when it actually sends connection attempts that can be logged and detected.
For the CompTIA PT0-002 exam, passive reconnaissance techniques such as open-source research and traffic sniffing minimize detection, while active techniques like ping sweeps and vulnerability scans are easily detected. Community consensus for this question strongly favors options A and C.
The most common wrong answer is choosing D (port knocking) instead of C (traffic sniffing), because port knocking seems stealthy and covert; however, it is still an active interaction with the target that generates packets, making it detectable, whereas passive traffic sniffing generates no network traffic.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Open-source research (A) is a passive technique that relies on publicly available information, requiring no direct interaction with the target, so it carries minimal detection risk. Traffic sniffing (C) is also passive when performed on a network segment where the tester can observe packets without injecting data; in its passive form, it does not generate traffic that would alert the target. Together these are the two clearly passive options listed, matching the community consensus in comment [3] that "only two that are passive."Why the Other Options Are Wrong
Ping sweep (B) and vulnerability scan (E) are active scanning techniques that send probes to target systems, generating logs and alerts and making them easy to detect. Port knocking (D) is not passive either; as comment [1] notes, if the tester does not know the exact sequence, guessing creates a lot of noise, and even a valid knock produces connection attempts that can be monitored. Port knocking may appear stealthy because it is used for covert access, but it still involves direct network interaction and therefore has a higher chance of detection than passive sniffing or OSINT.Community Comment Notes
The majority of voters (78) support AC, emphasizing that passivity is the key criterion. A minority (22) chose AD, likely confusing the intent of port knocking with passive reconnaissance. Comment [2] appears to argue for open-source research and port knocking, but its reasoning is incomplete, while the more technically precise comment [1] explains why port knocking fails the "minimal detection" test. Overall, the community consensus aligns with the suggested answer and reinforces the importance of recognizing active vs. passive techniques.Official Reference
Exam Strategy
When asked about detection risk, classify each activity as passive or active. Passive activities such as OSINT and passive sniffing are generally undetectable, while anything that sends packets or directly interacts with the target—ping sweeps, port knocking, vulnerability scans—carries a higher detection risk. Remember that 'traffic sniffing' is passive only when you are not actively manipulating the network.