CEH Network and Web Application Attacks Practice Question
Exhibit
nslookup www.example.com
Server: UnKnown
Address: 192.168.1.1
Non-authoritative answer:
Name: www.example.com
Addresses: 10.0.0.1
10.0.0.2
203.0.113.5
dig @192.168.1.1 www.example.com
;; ANSWER SECTION:
www.example.com. 60 IN A 10.0.0.1
www.example.com. 60 IN A 10.0.0.2
www.example.com. 60 IN A 203.0.113.5Refer to the exhibit. A penetration tester observes that the DNS server returns both internal (10.0.0.0/8) and external (203.0.113.5) IP addresses for the same domain. What is this technique called?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Split DNS misconfiguration
Split-Horizon DNS, commonly known as Split DNS, is a crucial network architecture design pattern that enhances both security and efficiency. It operates by maintaining two distinct views of a DNS zone: one for internal network clients and another for external internet clients. For instance, an internal client querying 'www.example.com' might receive a private IP address (e.g., 10.0.0.5) pointing to an internal web server, while an external client receives a public IP address (e.g., 203.0.113.10). This prevents internal network topology from being exposed to the public internet and allows internal clients to access resources directly without traversing external firewalls. Misconfigurations, such as returning both internal and external IPs, can lead to information leakage, potential routing issues, or even facilitate internal network reconnaissance by external attackers if the internal IPs are routable or provide clues about the internal infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS cache poisoning
Why it's wrong here
DNS cache poisoning involves an attacker injecting forged or malicious DNS records into a resolver's cache, causing it to return incorrect IP addresses for legitimate domains. This attack aims to redirect users to malicious sites or intercept traffic. However, the scenario describes a legitimate DNS response containing both internal and external IPs simultaneously, indicating a configuration error rather than a malicious injection into the cache.
- ✓
Split DNS misconfiguration
Why this is correct
Split DNS, or Split-Horizon DNS, is designed to provide different DNS responses based on the client's network location, typically serving internal IP addresses to internal users and external IP addresses to external users for the same hostname. A misconfiguration occurs when the DNS server fails to properly differentiate client origins, or is configured to return both internal and external records simultaneously in a single response, thereby exposing internal network topology or causing connectivity issues.
- ✗
DNS rebinding
Why it's wrong here
DNS rebinding is an attack technique where a malicious DNS server provides a very short Time-To-Live (TTL) for a domain's A record, allowing it to quickly change the associated IP address from an external, attacker-controlled server to an internal, private IP address. This enables an attacker to bypass same-origin policy restrictions in web browsers. The scenario, however, describes multiple IP addresses being returned simultaneously in a single query response, which is distinct from the sequential IP switching characteristic of rebinding.
- ✗
DNS zone transfer
Why it's wrong here
A DNS zone transfer is a mechanism used to replicate DNS database records from a primary DNS server to a secondary DNS server, ensuring redundancy and load balancing. This process involves transferring the entire zone file, or a significant portion of it, containing all resource records for a domain. The observation in the question describes a standard DNS query response containing multiple A records, not the bulk data transfer operation characteristic of a zone transfer.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.