CEH Footprinting, Reconnaissance and Scanning Practice Question
A penetration tester wants to perform DNS zone transfer enumeration. Which TWO of the following tools can be used for this purpose? (Select exactly 2.)
⚠ Common exam trap
EC-Council often tests the distinction between passive reconnaissance tools (theHarvester, Maltego) and active DNS enumeration tools (dnsrecon, dnsenum) that directly query DNS servers for zone transfers, leading candidates to select tools that gather DNS data indirectly rather than performing the actual AXFR request.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
dnsrecon
Dnsrecon is a dedicated DNS enumeration tool that supports zone transfer requests (AXFR queries) to retrieve all DNS records from a nameserver if it is misconfigured to allow transfers from any host. It can also perform other DNS reconnaissance tasks such as SRV record enumeration and subdomain brute-forcing, making it a direct choice for zone transfer enumeration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Shodan
Why it's wrong here
Shodan is an internet search engine that discovers and indexes internet-connected devices, services, and open ports by analyzing banners and metadata. While excellent for identifying public-facing assets and potential vulnerabilities, it operates by scanning and cataloging existing services, not by actively performing DNS zone transfer requests. Its primary function is asset discovery and vulnerability intelligence, rather than specific DNS enumeration techniques.
- ✗
Maltego
Why it's wrong here
Maltego is a powerful open-source intelligence (OSINT) and graphical link analysis tool designed to gather and visualize relationships between various entities like domains, IPs, and organizations. Although it can integrate with other tools or scripts that perform DNS enumeration via 'transforms,' Maltego itself is a data aggregation and visualization platform, not a direct utility for initiating DNS zone transfer requests. It relies on external data sources and pre-built transforms to populate its graphs.
- ✗
theHarvester
Why it's wrong here
theHarvester is an open-source intelligence (OSINT) tool primarily used for gathering email addresses, subdomains, hostnames, and employee names from publicly available sources like search engines, PGP key servers, and Shodan. Its function is to collect publicly available information to aid in the initial reconnaissance phase of a penetration test. However, it lacks the specific functionality to attempt a DNS zone transfer from a name server, focusing on passive information gathering rather than active DNS queries.
- ✓
dnsrecon
Why this is correct
dnsrecon is a dedicated DNS enumeration script specifically designed to gather extensive information about DNS infrastructure. It actively attempts various DNS queries, including brute-forcing subdomains, checking for wildcards, and crucially, attempting zone transfers (AXFR requests) against identified name servers. This tool is specifically built to uncover misconfigured DNS servers that might inadvertently disclose internal network details through successful zone transfers, making it highly effective for this task.
- ✓
dnsenum
Why this is correct
dnsenum is a comprehensive multi-threaded Perl script specifically engineered for DNS enumeration during reconnaissance. It automates several DNS-related information gathering techniques, including querying for host records, mail servers, and name servers, and prominently features the capability to attempt a DNS zone transfer. By sending AXFR requests to target DNS servers, dnsenum aims to retrieve a full list of all hosts configured within a domain, providing valuable insight into the target's network structure.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.