CEH Footprinting and Reconnaissance Practice Question

During the reconnaissance phase, a tester discovers that the target company's email server is configured to automatically respond to delivery status notifications (DSNs). Which type of attack could this information facilitate?

⚠ Common exam trap

EC-Council often tests the distinction between passive reconnaissance (like email enumeration via DSN) and active attacks (like MITM or phishing), so candidates mistakenly choose 'Phishing attack' because they associate email servers with phishing, but the question specifically asks what the DSN behavior facilitates during reconnaissance.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Email enumeration

Email servers that automatically respond to Delivery Status Notifications (DSNs) as defined in RFC 1891/3464 can be exploited for email enumeration. By sending a message to a non-existent address, the DSN response will indicate the address is invalid, while a valid address may generate no DSN or a different response. This allows an attacker to systematically verify valid email addresses on the target domain without triggering a full bounce-back to the original sender.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
DNS cache poisoning
Why it's wrong here
DNS cache poisoning is an attack technique where an attacker injects forged DNS records into a DNS resolver's cache, causing it to return incorrect IP addresses for legitimate domains. This misdirection typically aims to redirect users to malicious sites or intercept traffic, and it occurs *after* initial reconnaissance, requiring active manipulation of DNS infrastructure rather than passive information gathering via DSN responses. It's an exploitation phase activity, not a reconnaissance discovery.
✓
Email enumeration
Why this is correct
Email enumeration is a reconnaissance technique used to discover valid email addresses within an organization. When an email is sent to a non-existent address, the mail server often returns a Delivery Status Notification (DSN) or Non-Delivery Report (NDR) indicating the address was invalid. Conversely, the *absence* of such a bounce, or a specific DSN indicating a deferred delivery rather than an immediate rejection, can confirm the validity of an email address, making DSN responses a valuable tool for identifying active accounts.
✗
Man-in-the-middle attack
Why it's wrong here
A Man-in-the-Middle (MITM) attack involves an attacker secretly relaying and potentially altering the communication between two parties who believe they are directly communicating with each other. This active interception and manipulation of network traffic, often requiring ARP spoofing or DNS spoofing, is an exploitation technique rather than a passive reconnaissance method for discovering valid email addresses through DSN responses. It's a post-reconnaissance attack vector.
✗
Phishing attack
Why it's wrong here
A phishing attack is a social engineering technique where attackers attempt to trick individuals into revealing sensitive information, such as login credentials or financial details, by masquerading as a trustworthy entity in an electronic communication. This method relies on deception and user interaction, typically through fraudulent emails or websites, and is an active exploitation phase attack, not a passive reconnaissance technique involving the analysis of DSN responses to enumerate email addresses.

Go deeper

CEH Footprinting and Reconnaissance Practice Question

Why each option matters

Option-by-option breakdown

Related to this question