CEH Footprinting, Reconnaissance and Scanning Practice Question

An analyst runs the following command: dnsenum --enum example.com. Which of the following actions is dnsenum performing?

⚠ Common exam trap

Many candidates confuse `dnsenum` with other DNS tools like `nslookup` or `dig`, assuming it only performs simple queries, when in fact its `--enum` mode specifically targets zone transfers and subdomain brute-forcing.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Attempts a zone transfer and brute-forces subdomains

The `dnsenum` tool is designed for DNS enumeration, and its `--enum` flag performs a comprehensive scan that includes attempting a zone transfer (AXFR query) to retrieve all DNS records from the nameserver, and if that fails, it brute-forces subdomains using a wordlist. This matches option A exactly.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Attempts a zone transfer and brute-forces subdomains
Why this is correct
The `dnsenum enum exampl` command, specifically utilizing the `enum` option, instructs the `dnsenum` tool to perform a comprehensive DNS reconnaissance. This process primarily involves attempting a zone transfer (AXFR) from the target DNS server, which, if successful due to misconfiguration, can reveal all DNS records for the domain. Following this, `dnsenum` proceeds to brute-force subdomains by iterating through a built-in or user-provided wordlist, querying for A records to discover additional hosts within the domain.
✗
Scans for open ports on the DNS server
Why it's wrong here
Scanning for open ports is a distinct network reconnaissance activity, typically performed by tools like Nmap, which probes specific TCP or UDP ports on a target host to determine if services are listening. `dnsenum`, by contrast, is purpose-built for gathering DNS-related information, such as hostnames, mail servers, and name servers, rather than identifying the operational status of network ports. Therefore, the `enum` command does not initiate a port scan on the DNS server itself.
✗
Queries the DNS server for its version information
Why it's wrong here
While obtaining DNS server version information can be a valuable reconnaissance step, often achieved by querying specific TXT records like `version.bind` (e.g., using `dig @ns1.example.com CH TXT version.bind`), this is not the primary function or an automatic inclusion of the `dnsenum enum` command. The `enum` option focuses on enumerating domain records and subdomains through zone transfers and brute-forcing, rather than directly querying for the software version of the DNS daemon.
✗
Performs a reverse DNS lookup to find PTR records for the IP range
Why it's wrong here
Performing a reverse DNS lookup involves resolving an IP address back to its corresponding hostname using Pointer (PTR) records, typically found in the `in-addr.arpa` or `ip6.arpa` domains. Although `dnsenum` can be configured to perform reverse lookups with specific flags, the `enum` command, when used alone, prioritizes forward DNS enumeration techniques like zone transfers and subdomain brute-forcing. It does not primarily focus on systematically mapping entire IP ranges to hostnames via PTR records.

Visual reference

Go deeper

CEH Footprinting, Reconnaissance and Scanning Practice Question

Why each option matters

Option-by-option breakdown

Related to this question