Attackers use tools to identify subdomains related to the target bucket.

• A. Port Scanning
• B. Finding Subdomains
• C. Subnetting
• D. Brute-Force Password

Answer: (B)

Subdomain discovery is about mapping a target’s DNS surface by identifying all subdomains that point to assets under the domain. Attackers perform this during recon to see what services and hosts exist under the target, which can reveal points of exposure and additional infrastructure to assess. That makes the option about finding subdomains the best fit, because it describes the exact activity of enumerating subdomains related to the target bucket.

Port scanning, by contrast, focuses on which ports are open on a given host, not on discovering the subdomain names themselves. Subnetting is about dividing networks into smaller segments, not about listing subdomains. Brute-forcing passwords targets credentials, not the discovery of domain components.