CEH Footprinting, Reconnaissance and Scanning Practice Question
Which THREE of the following are correct statements about DNS zone transfers?
⚠ Common exam trap
Candidates often confuse DNS query transport (UDP 53) with zone transfer transport (TCP 53), and assume zone transfers are encrypted by default when they are not.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A successful zone transfer reveals all DNS records for the domain
A successful DNS zone transfer (AXFR) returns the complete zone file, which contains all DNS records for the domain, including A, AAAA, MX, CNAME, NS, and TXT records. This is why it is a critical information-gathering step during reconnaissance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A successful zone transfer reveals all DNS records for the domain
Why this is correct
A successful DNS zone transfer (AXFR or IXFR) is designed to replicate the entire DNS zone file from a primary (master) DNS server to a secondary (slave) DNS server. This process inherently exposes all resource records (A, AAAA, MX, NS, SOA, SRV, TXT, etc.) configured for that specific domain. Consequently, an attacker who successfully performs an unauthorized zone transfer gains comprehensive knowledge of the domain's network infrastructure and hosts.
- ✓
The tool dnsrecon can attempt a zone transfer
Why this is correct
The dnsrecon tool is a powerful DNS enumeration script specifically designed for reconnaissance during penetration testing. Among its various capabilities, dnsrecon includes a built-in feature to attempt a zone transfer against a target DNS server. This functionality allows security professionals to quickly identify if a server is misconfigured to permit unauthorized zone transfers, which could lead to significant information disclosure.
- ✗
Zone transfers are encrypted by default
Why it's wrong here
Standard DNS zone transfers, utilizing the AXFR or IXFR mechanisms, are transmitted in plain text over TCP port 53. There is no inherent encryption built into the DNS protocol itself for these operations. While mechanisms like Transaction Signature (TSIG) can be employed to authenticate the transfer between authorized servers, TSIG only provides integrity and authentication, not confidentiality or encryption of the data payload.
- ✓
Zone transfers should be restricted to authorized secondary DNS servers
Why this is correct
Restricting zone transfers to only authorized secondary DNS servers is a critical security best practice to prevent information leakage. By configuring the primary DNS server to only allow zone transfers to specific IP addresses of trusted secondary servers, administrators can mitigate the risk of unauthorized parties obtaining a complete list of internal hosts and services. This prevents attackers from easily mapping out a target's network infrastructure.
- ✗
Zone transfers use UDP port 53
Why it's wrong here
DNS zone transfers specifically utilize TCP port 53, not UDP port 53. The Transmission Control Protocol (TCP) is chosen for zone transfers because it provides reliable, connection-oriented communication, which is essential for ensuring the complete and accurate transfer of potentially large DNS zone files. In contrast, UDP port 53 is primarily used for standard, small DNS queries and responses due to its speed and connectionless nature.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.