The correct answer is AXFR, because this DNS record type, when misconfigured to allow unrestricted zone transfers from any IP, enables an attacker to request and receive the entire DNS zone file for a domain like example.com. AXFR stands for Asynchronous Full Transfer, and it is the standard protocol used to replicate DNS zone data between primary and secondary servers; if the server is set to respond to AXFR queries from any host without restriction, an external attacker can dump all DNS records, revealing internal network topology and potential attack surfaces. On the Certified Ethical Hacker CEH exam, this scenario tests your understanding of DNS enumeration techniques and common misconfigurations—a frequent trap is confusing AXFR with incremental zone transfers (IXFR) or assuming that failed attempts mean the service is secure, when in fact the attacker is simply probing for an open port. A solid memory tip: think of AXFR as “All XFer” because it transfers the entire zone, so if it’s open to anyone, the whole domain is exposed.
CEH Footprinting, Reconnaissance and Scanning Practice Question
This CEH practice question tests your understanding of footprinting, reconnaissance and scanning. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An incident responder analyzes logs and finds repeated failed zone transfer attempts from an external IP. The zone transfer requests are targeting the domain example.com. Which DNS record type, if misconfigured, would allow this attack to succeed?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AXFR
B is correct because AXFR (Asynchronous Full Transfer) is the DNS zone transfer protocol that, if misconfigured (i.e., allowing unrestricted AXFR queries from any IP), permits an external attacker to request and receive the entire DNS zone file for example.com. The repeated failed attempts indicate the attacker is probing for an open AXFR service, which would succeed if the DNS server is configured to allow zone transfers to any host without restriction.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
NS records
Why it's wrong here
NS records specify authoritative name servers; they do not control zone transfer permissions.
✓
AXFR
Why this is correct
AXFR is the DNS query type for zone transfers. Allowing AXFR from unauthorized hosts is a misconfiguration.
Related concept
Read the scenario before looking for a memorised answer.
✗
MX records
Why it's wrong here
MX records specify mail servers; they are not related to zone transfers.
✗
SOA records
Why it's wrong here
SOA records contain administrative information but do not control zone transfer permissions.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse the DNS record type (e.g., NS, SOA) with the protocol or query type (AXFR) used to perform the zone transfer, leading them to select a record type instead of recognizing AXFR as the specific misconfiguration that enables the attack.
Detailed technical explanation
How to think about this question
Under the hood, DNS zone transfers use TCP port 53 (not UDP) and are initiated with an AXFR query; a properly secured DNS server should restrict AXFR to trusted secondary DNS servers via IP allow lists or TSIG (Transaction Signatures, RFC 2845). In real-world scenarios, misconfigured DNS servers on internal networks or cloud environments have been exploited to leak internal hostnames, IP addresses, and network topology, aiding further reconnaissance like subdomain enumeration or targeted attacks.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CEH question in full detail.
Footprinting, Reconnaissance and Scanning — This question tests Footprinting, Reconnaissance and Scanning — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: AXFR — B is correct because AXFR (Asynchronous Full Transfer) is the DNS zone transfer protocol that, if misconfigured (i.e., allowing unrestricted AXFR queries from any IP), permits an external attacker to request and receive the entire DNS zone file for example.com. The repeated failed attempts indicate the attacker is probing for an open AXFR service, which would succeed if the DNS server is configured to allow zone transfers to any host without restriction.
What should I do if I get this CEH question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a security assessment, you execute: dnsenum --enum example.com. The tool returns results including the nameservers (NS), mail servers (MX), and performs a zone transfer attempt. The zone transfer fails. What is the MOST likely reason for the failure?
hard
A.The DNS server is not running
B.The zone transfer requires TCP port 443
✓ C.The DNS server is configured to deny zone transfers from unauthorized hosts
D.The domain does not exist
Why C: Option C is correct because DNS zone transfers (AXFR) are typically restricted by default on authoritative DNS servers to prevent unauthorized disclosure of the entire zone file. The `dnsenum` tool attempts an AXFR query over TCP port 53, and the failure indicates the server explicitly denied the request, which is a standard security configuration per RFC 5936.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.