Exam 312-50v13 Topic 1 Question 508 Discussion

Actual exam question for ECCouncil's 312-50v13 exam
Question #: 508
Topic #: 1
Henry is a penetration tester who works for XYZ organization. While performing enumeration on a client organization, he queries the DNS server for a specific cached DNS record. Further, by using this cached record, he determines the sites recently visited by the organization's user.
What is the enumeration technique used by Henry on the organization?

Suggested Answer: B Vote an answer

DNS cache snooping is an enumeration technique where the attacker queries a DNS server to check whether a specific domain has been recently resolved by the server (i.e., it exists in the cache). If a positive response is received with low latency, it indicates that the domain was visited recently.
Key points:
* Used to infer user browsing habits or visited domains.
* Helps attackers identify user interests or potential targets.
Incorrect Options:
* A. DNS zone walking is used to list all domain names in a DNS zone (with misconfigured DNS servers), not for cached record inspection.
* C. DNSSEC zone walking applies only when DNSSEC is misconfigured.
* D. DNS cache poisoning is a manipulation technique, not a passive enumeration method.
Reference - CEH v13 Official Courseware:
Module 04: Enumeration
Section: "DNS Enumeration"
Subsection: "DNS Cache Snooping and Timing Analysis"
Tool Reference: dig, nslookup

by Clement at May 30, 2026, 07:47 AM

Limited Time Offer

15%

Off

Get Premium 312-50v13 Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10