CEH Footprinting, Reconnaissance and Scanning Practice Question
A penetration tester receives the following output from a tool: 'Starting dnsrecon.py -d example.com -t axfr' and then a list of all DNS records. Which of the following BEST describes what occurred?
⚠ Common exam trap
A common mix-up: candidates confuse the '-t axfr' zone transfer flag with other DNS reconnaissance techniques like cache snooping or DNSSEC validation, but the key indicator is the explicit request for a full zone transfer and the resulting complete list of DNS records.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A successful DNS zone transfer was performed, revealing all DNS records for the domain
The output shows the dnsrecon tool being run with the '-t axfr' option, which specifically requests a DNS zone transfer (AXFR). A zone transfer is a mechanism for replicating DNS databases across DNS servers, and if misconfigured, it allows an attacker to retrieve all DNS records for a domain. The successful listing of all DNS records confirms that the zone transfer was permitted by the target's DNS server, revealing the entire DNS zone.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A DNSSEC validation check was completed
Why it's wrong here
DNSSEC validation is a cryptographic process that verifies the authenticity and integrity of DNS data using digital signatures (RRSIG records) and public keys (DNSKEY records) to prevent tampering. An AXFR request, however, is a simple data retrieval mechanism for an entire zone, not a validation check. The output of a zone transfer merely lists records; it does not include any indicators of cryptographic validation or signature verification, making it distinct from a DNSSEC operation.
- ✓
A successful DNS zone transfer was performed, revealing all DNS records for the domain
Why this is correct
A successful DNS zone transfer, initiated by an AXFR query, occurs when an authoritative name server provides a complete copy of its entire DNS zone file. This typically happens due to a security misconfiguration where the server allows unrestricted transfers to unauthorized clients. The output received by the penetration tester, containing all DNS records for the domain, is the direct result of such a successful transfer, providing a comprehensive enumeration of the domain's infrastructure.
- ✗
A DNS cache snooping attack was executed
Why it's wrong here
DNS cache snooping is a reconnaissance technique where an attacker queries a recursive DNS resolver to determine if specific domain names or records are already present in its cache. This method aims to infer recently visited domains or internal network structures without directly interacting with the authoritative server for a full zone dump. Unlike an AXFR request, which retrieves all records, cache snooping only probes for the existence of individual records and does not yield a complete zone file.
- ✗
A reverse DNS lookup was performed to find domain names from IP addresses
Why it's wrong here
A reverse DNS lookup translates an IP address into a corresponding hostname, primarily by querying PTR records within the `in-addr.arpa` or `ip6.arpa` domains. This process is fundamentally different from an AXFR request, which is designed to retrieve all forward-mapping records (e.g., A, MX, NS) for a given domain from its authoritative name server. The `dnsrecon -t axfr` command explicitly targets a zone transfer, not a reverse lookup operation.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.