PT0-002 Reconnaissance and Enumeration Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  DNS zone transfer

  Why this is correct

  A DNS zone transfer (AXFR) is a legitimate replication mechanism that copies the entire zone file from a primary to a secondary DNS server. When misconfigured to allow unrestricted AXFR, it exposes every record in the zone, including internal host names, IP addresses, and service records, giving an attacker a complete map of the target's network. This makes it the definitive enumeration technique because it returns the full data set in one query.

• ✗

  DNS reverse lookup

  Why it's wrong here

  DNS reverse lookup queries the PTR record to map a specific IP address back to a hostname, functioning as a one-to-one resolution rather than a bulk data retrieval. To enumerate subdomains this way, a tester would need to already know an entire IP range and perform a reverse DNS scan, which only reveals names for active addresses and is both slow and incomplete. It does not request the zone file, so it cannot expose the full list of hostnames that a zone transfer would reveal.

• ✗

  DNS cache snooping

  Why it's wrong here

  DNS cache snooping involves sending a query to a recursive resolver for a specific domain name and determining whether that record is already in its cache, often by measuring response time or the presence of the 'Non-Authoritative' flag. This reveals what other clients have recently queried, potentially exposing user activity or internal hostnames, but it only provides a yes/no answer for the single queried name. It cannot dump the entire zone and is therefore not a subdomain enumeration technique like a zone transfer.

• ✗

  DNS tunneling

  Why it's wrong here

  DNS tunneling is a covert communication method that encapsulates non-DNS payloads, such as HTTP or SSH, within DNS query and response packets, typically using subdomain labels or TXT records for data exfiltration and command-and-control. The attacker operates their own authoritative server to receive the tunneled data, which has nothing to do with the victim's zone contents. It is an evasion and C2 technique, not a reconnaissance method, and thus cannot reveal the target's complete DNS records like a zone transfer.

Go deeper

Related to this question