CEH Footprinting, Reconnaissance and Scanning Practice Question
A security engineer is concerned about DNS zone transfer attacks. Which of the following countermeasures would be MOST effective in preventing unauthorized zone transfers?
⚠ Common exam trap
Watch out — candidates often confuse DNSSEC (which protects data integrity) with access control mechanisms, or they mistakenly think disabling recursion or changing ports will prevent zone transfers, when in fact zone transfers are controlled by explicit authorization settings on the authoritative server.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restrict zone transfers to authorized IP addresses only
Restricting zone transfers to authorized IP addresses only is the most effective countermeasure because it directly controls which DNS servers are allowed to request a full copy of the zone data. By configuring an allow-transfer list (e.g., using the 'allow-transfer { trusted_servers; };' directive in BIND), the primary DNS server will reject zone transfer requests from any unauthorized IP, preventing attackers from enumerating all DNS records.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Restrict zone transfers to authorized IP addresses only
Why this is correct
DNS zone transfers, specifically AXFR (full zone transfer) and IXFR (incremental zone transfer), are designed to replicate DNS zone data between primary and secondary name servers. By configuring the authoritative DNS server to only permit these transfers from a predefined list of trusted IP addresses (typically the secondary DNS servers), an administrator directly prevents unauthorized entities from enumerating an entire domain's host records. This access control mechanism is the primary and most effective defense against malicious reconnaissance via zone transfers.
- ✗
Use DNSSEC to sign the zone
Why it's wrong here
DNSSEC (Domain Name System Security Extensions) employs cryptographic signatures to authenticate the origin of DNS data and ensure its integrity, primarily protecting against cache poisoning and DNS spoofing attacks. While it adds a layer of trust to DNS responses, DNSSEC does not inherently restrict or prevent the actual transfer of zone data itself. An attacker could still request and receive a signed zone transfer, although the signatures would confirm the data's authenticity, not its confidentiality or restricted access.
- ✗
Change the default port of 53 to a non-standard port
Why it's wrong here
Changing the default DNS port from 53 (TCP/UDP) to a non-standard port is an example of "security by obscurity," which is generally ineffective. Legitimate DNS clients and resolvers are hardcoded to query port 53, meaning such a change would break standard DNS resolution for most users. Furthermore, an attacker can easily discover open ports through common port scanning tools like Nmap, quickly identifying the new port and rendering this measure useless against a determined adversary.
- ✗
Disable DNS recursion on the server
Why it's wrong here
Disabling DNS recursion means the server will only respond to queries for zones it is authoritative for and will not forward requests to other DNS servers to resolve external domain names. This configuration is common for authoritative-only name servers to prevent them from being used in DNS amplification attacks. However, zone transfers (AXFR/IXFR) are a distinct function involving the replication of authoritative zone data, and disabling recursion does not inherently block or restrict these specific transfer requests.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.