CEH Footprinting, Reconnaissance and Scanning Practice Question
During a penetration test, you need to enumerate all DNS records for example.com using a zone transfer. Which TWO tools can be used to attempt this?
⚠ Common exam trap
A common mix-up: candidates confuse tools that can manually perform a zone transfer (like dig or nslookup) with dedicated enumeration tools that automate the process across multiple nameservers, leading them to select dig or nslookup instead of dnsenum and dnsrecon.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
dnsenum
Options A (dnsenum) and C (dnsrecon) are both specialized DNS enumeration tools that can attempt a full zone transfer (AXFR query) to retrieve all DNS records for a domain. dnsenum automates zone transfer attempts against multiple nameservers, while dnsrecon includes similar functionality. Although tools like dig and nslookup can also perform manual zone transfers, the question specifically asks for tools designed for enumeration, making dnsenum and dnsrecon the correct choices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
dnsenum
Why this is correct
dnsenum is a powerful and comprehensive tool specifically designed for DNS enumeration during penetration tests. It automates various techniques, including attempting AXFR (Asynchronous Zone Transfer) requests, brute-forcing subdomains from a wordlist, performing reverse lookups on IP ranges, and querying for multiple DNS record types like MX, NS, and A records. This multi-faceted approach allows it to gather extensive information about a target's DNS infrastructure efficiently.
- ✗
dig
Why it's wrong here
dig (Domain Information Groper) is a versatile command-line utility primarily used for querying DNS name servers and troubleshooting DNS issues. While it can be manually instructed to attempt an AXFR zone transfer, it functions as a diagnostic tool for specific lookups rather than a dedicated, automated enumeration suite. It lacks the integrated features for brute-forcing, reverse lookups across ranges, or combining multiple enumeration techniques that specialized tools offer for comprehensive discovery.
- ✓
dnsrecon
Why this is correct
dnsrecon is an advanced DNS enumeration script that actively gathers detailed information about a target's DNS configuration. It goes beyond simple zone transfer attempts by checking all Name Servers for zone transfers, performing brute-force enumeration of common subdomains, conducting reverse lookups, and even querying external sources like Google for additional subdomain discovery. Its robust capabilities make it highly effective for uncovering extensive DNS infrastructure details during reconnaissance.
- ✗
theHarvester
Why it's wrong here
theHarvester is an open-source intelligence (OSINT) tool focused on gathering publicly available information from various sources like search engines, PGP servers, and Shodan. It operates passively, meaning it does not directly interact with the target's DNS servers to perform active queries or request zone transfers. Its purpose is to find email addresses, subdomains, and hostnames through public data, not to actively enumerate DNS records by direct server interaction.
- ✗
nslookup
Why it's wrong here
nslookup (Name Server Lookup) is a basic command-line tool for querying DNS to obtain domain name or IP address mapping. While it can be manually used to attempt a zone transfer by setting the query type to ANY and specifying a name server, its functionality is very limited for comprehensive enumeration. It requires manual, iterative queries for different record types and lacks the automated intelligence and advanced features that specialized tools like dnsenum or dnsrecon provide for efficient and thorough DNS reconnaissance.
Visual reference
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.