PT0-002 Practice Question: A penetration tester is performing reconnaissance…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Perform a DNS zone transfer

  Why it's wrong here

  A DNS zone transfer (AXFR) attempts to copy the entire zone file from a primary DNS server, but public-facing servers almost universally restrict AXFR to authorized secondary servers, so it rarely succeeds—and even when it does, it is a direct DNS enumeration technique, not a follow-on from the SPF include chain. The target's SPF record's include mechanism simply points to another domain for TXT-record processing, while zone transfer targets the authoritative server for the original domain and does not leverage that third-party relationship.

• ✗

  Enumerate MX records for the third-party

  Why it's wrong here

  Enumerating MX records for the third-party domain reveals the mail exchanger hosts, which are typically outsourced to services like Office 365 or Google Workspace. This only tells you who handles the third-party's email, not the target's internal subdomains or the nested SPF include path—the include:mechanism in SPF is about constructing an allowed sender list by querying TXT records, not about MX routing, so MX records do not expose other domains in the SPF chain.

• ✓

  Query the TXT records of the third-party domain

  Why this is correct

  Querying the TXT records of the third-party domain is correct because the target's SPF record contains an include: directive that tells the receiver to perform a DNS TXT query on that third-party domain to fetch its SPF policy. That third-party's TXT records may themselves include other domains, or list additional authorized sending hosts/subdomains, thereby mapping out the full SPF include chain and expanding the attacker's view of the target's infrastructure. This is a direct, low-noise recon technique that exploits the trust relationship encoded in SPF, which is exactly what the scenario hints at.

• ✗

  Use Google dorks to find exposed email addresses

  Why it's wrong here

  Google dorking for exposed email addresses is a broad passive reconnaissance tactic that searches public web indexes and documents, but it does not engage with the DNS-based SPF include mechanism at all. Emails found via Google may reveal user accounts or internal naming conventions, yet they do not directly disclose the third-party domain named in the SPF include, nor do they reveal subsequent TXT records or nested include: chains. Thus it is a valid OSINT method but unrelated to the specific SPF include clue in the question.

Go deeper

Related to this question