CEH Footprinting and Reconnaissance Practice Question
Exhibit
Refer to the exhibit. C:\>nslookup -type=MX example.com Server: dns.example.com Address: 192.0.2.10 example.com MX preference = 10, mail exchanger = mail1.example.com example.com MX preference = 20, mail exchanger = mail2.example.com
Refer to the exhibit. An attacker runs the nslookup command shown. What information has been gathered?
⚠ Common exam trap
Many exam-takers confuse DNS record types—specifically, they may think MX records return IP addresses or SPF data, when in fact MX only returns mail server hostnames and priorities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mail server addresses and priority
The nslookup command with the -type=MX query returns mail exchange (MX) records for the domain. The output shows mail server hostnames and their associated priority values (e.g., 10, 20), which indicate the order in which mail servers should be used. This directly reveals the mail server addresses and their priority, making option A correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Mail server addresses and priority
Why this is correct
When an attacker runs `nslookup` without specifying a query type, the command often defaults to querying A records but will frequently display Mail Exchanger (MX) records if they are configured for the domain, as these are critical for email routing. MX records explicitly list the mail servers responsible for accepting email on behalf of a domain and assign a numerical preference value, indicating the priority for delivery. This allows email clients to attempt delivery to the lowest-preference server first, ensuring redundancy and load balancing.
- ✗
Name server records
Why it's wrong here
Name Server (NS) records identify the authoritative DNS servers for a domain, delegating responsibility for that zone. While crucial for DNS resolution, `nslookup` does not display NS records by default; a specific query type, such as `set type=NS` or `nslookup -query=NS`, must be explicitly used to retrieve this information. Therefore, a basic `nslookup` command, as implied by the exhibit, would not primarily yield NS records.
- ✗
IP addresses of the web server
Why it's wrong here
IP addresses of web servers are typically stored in A records for IPv4 or AAAA records for IPv6, which map a hostname to its corresponding IP address. While `nslookup` defaults to querying A records, the question's correct answer specifically points to mail server information, implying the output primarily highlighted MX records. Thus, even if A records might be part of a default query, the core information being sought or presented in the correct context is not the web server's IP.
- ✗
SPF records for email authentication
Why it's wrong here
Sender Policy Framework (SPF) records are vital for email authentication, helping to prevent email spoofing by specifying which hosts are authorized to send mail for a domain. SPF information is published within DNS as TXT (text) records. To retrieve SPF records using `nslookup`, an attacker would need to explicitly set the query type to TXT, for example, by using `set type=TXT` before the domain query, as they are not part of a default `nslookup` output.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An ethical hacker runs the command shown in the exhibit. Which of the following conclusions can be drawn from the output?
medium- ✓ A.The domain has two mail exchange servers
- B.The DNS server is configured to block zone transfers
- C.Mail is automatically forwarded to a backup server
- D.The domain has an SPF record configured
Why A: The output shows two MX records for the domain, each with a preference value (10 and 20). MX records specify mail exchange servers, and the presence of two distinct entries indicates the domain has two mail exchange servers. The lower preference value (10) is the primary server, and the higher value (20) is a secondary or backup server.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.