CEH Footprinting, Reconnaissance and Scanning Practice Question
During a reconnaissance phase, a tester uses `dnsrecon -d example.com -t axfr`. What specific DNS query is being attempted?
⚠ Common exam trap
Watch out — candidates often confuse `-t axfr` with other reconnaissance techniques like brute-forcing or record enumeration, but the CEH exam specifically tests the exact command flag for zone transfers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A zone transfer request
The `-t axfr` flag in `dnsrecon` specifies a zone transfer request (AXFR). This query attempts to retrieve the entire DNS zone file from a nameserver, which can reveal all DNS records for the domain. A successful zone transfer is a critical misconfiguration because it exposes internal network topology and hostnames.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A subdomain brute-force
Why it's wrong here
A subdomain brute-force attack involves systematically guessing subdomains using a predefined wordlist to discover hidden hosts. The dnsrecon tool performs this specific function when the -t brt (brute-force) flag is explicitly provided, often in conjunction with a -w (wordlist) flag. The command dnsrecon -d example.com without any type flag defaults to attempting a zone transfer, not a brute-force, making this option incorrect.
- ✓
A zone transfer request
Why this is correct
When dnsrecon is executed with only the domain specified, such as dnsrecon -d example.com, its default behavior is to attempt a DNS zone transfer (AXFR). This process requests a full copy of the DNS zone file from the authoritative name server. If the server is misconfigured to allow unauthorized zone transfers, the tester can obtain a comprehensive list of all hostnames, IP addresses, and other DNS records for the domain, providing extensive reconnaissance data.
- ✗
A reverse DNS lookup
Why it's wrong here
A reverse DNS lookup is a distinct operation that translates an IP address back into its corresponding domain name, rather than resolving a domain name to an IP. To perform a reverse DNS lookup with dnsrecon, the -t rvl (reverse lookup) flag must be used, typically along with an IP address or range. The command dnsrecon -d example.com targets the domain itself for forward lookups or zone transfers, not for reversing IP addresses.
- ✗
A SRV record enumeration
Why it's wrong here
SRV record enumeration specifically targets Service (SRV) records, which are used to locate servers for particular services, such as SIP or LDAP, by specifying hostname and port. This specialized query type requires the -t srv flag in dnsrecon to be explicitly invoked. The default execution of dnsrecon -d example.com does not specifically enumerate SRV records but rather attempts a broader zone transfer or standard record queries.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.