An incident responder is investigating a suspicious email received by an employee. The email appears to come from the CEO's address (ceo@company.com) and contains an embedded image. The email headers show 'Received: from mail.company.com (mail.company.com [203.0.113.5])' and 'Received: from unknown [198.51.100.23]'. The 'Return-Path' is 'attacker@evil.com'. The embedded image is hosted at 'tracking.evil.com'. What is the most likely scenario?

The email was sent from the CEO's actual mailbox, but the image is a legitimate marketing banner.

The email is legitimate but the CEO's email client automatically loaded the image from a third-party service.

The email was spoofed, and the embedded image is a tracking pixel used to confirm the recipient's email address.

The email is a phishing attempt, but the embedded image is harmless and does not reveal any information.

A security analyst is performing footprinting on a target organization. The Whois record for the target domain shows 'Registrant Organization: PrivacyGuard' and 'Registrant Email: contact@privacyguard.example'. The analyst also notices that the name servers are 'ns1.hostingcompany.com' and 'ns2.hostingcompany.com'. What is the most accurate conclusion from this data?

The organization is named 'PrivacyGuard' and uses a third-party email service.

The domain is not actively used because the registrant is hidden.

The domain is registered through a privacy protection service, so the true registrant details are hidden.

The domain is hosted on the privacy service's own infrastructure.

EC-CouncilCertified Ethical Hacker

Domain 2Objective 2

Whois, DNS and Email Footprinting CEH Practice Questions (Page 3)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

11concepts

Questions 11–15

11expert · hard
An incident responder is investigating a suspicious email received by an employee. The email appears to come from the CEO's address (ceo@company.com) and contains an embedded image. The email headers show 'Received: from mail.company.com (mail.company.com [203.0.113.5])' and 'Received: from unknown [198.51.100.23]'. The 'Return-Path' is 'attacker@evil.com'. The embedded image is hosted at 'tracking.evil.com'. What is the most likely scenario?
Select an answer first
12application · medium
You are performing DNS enumeration for a client. You need to identify the mail servers responsible for handling email for the target domain, and you also want to discover the authoritative name servers. Which two DNS record types should you query?
Select an answer first
13foundation · easy
Which DNS record type is used for reverse DNS lookups?
Select an answer first
14application · medium
A security analyst is performing footprinting on a target organization. The Whois record for the target domain shows 'Registrant Organization: PrivacyGuard' and 'Registrant Email: contact@privacyguard.example'. The analyst also notices that the name servers are 'ns1.hostingcompany.com' and 'ns2.hostingcompany.com'. What is the most accurate conclusion from this data?
Select an answer first
15foundation · easy
Which command-line tool is commonly used on Linux to perform a Whois query?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Whois, DNS and Email Footprinting CEH Practice Questions (Page 3)

Questions 11–15

You are performing DNS enumeration for a client. You need to identify the mail servers responsible for handling email for the target domain, and you also want to discover the authoritative name servers. Which two DNS record types should you query?

Which DNS record type is used for reverse DNS lookups?

Which command-line tool is commonly used on Linux to perform a Whois query?

Keep studying — Reconnaissance Techniques