What is the purpose of a reverse DNS lookup?

To map an IP address to a hostname

To identify the registrar of a domain

To find the mail server for a domain

To map a hostname to an IP address

You are testing a client's DNS infrastructure. You successfully performed a zone transfer against their primary name server and retrieved the entire zone file. Which immediate action should you take to minimize the risk of this being exploited by an attacker?

Change the domain's TTL values to a lower value.

Restrict zone transfers to authorized secondary name servers only.

Move the zone to a different DNS provider.

A penetration tester is tasked with gathering email addresses for a social engineering test. The target company has a website with a blog, a LinkedIn page, and a public GitHub repository. Which combination of methods would be most effective for harvesting email addresses?

Scrape the company website and search LinkedIn and GitHub for email addresses.

Use DNS enumeration to find mail servers and guess email addresses.

Send a phishing email to a guessed address and monitor for responses.

Perform a Whois lookup and use the registrant email address.

What information can be obtained from analyzing email headers?

The recipient's physical location

The plaintext password of the sender

The IP addresses of mail servers that handled the message

You are using nslookup to enumerate DNS records for a target domain. You want to find all mail servers and also verify the authoritative name servers. Which set of nslookup commands would accomplish both tasks?

set type=SOA then query the domain, then set type=TXT and query the domain again

set type=A then query the domain, then set type=AAAA and query the domain again

set type=ANY then query the domain once

set type=MX then query the domain, then set type=NS and query the domain again

EC-CouncilCertified Ethical Hacker

Domain 2Objective 2

Whois, DNS and Email Footprinting CEH Practice Questions (Page 7)

Part of the Reconnaissance Techniques domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~13–22 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

11concepts

Questions 31–35

31foundation · easy
What is the purpose of a reverse DNS lookup?
Select an answer first
32application · medium
You are testing a client's DNS infrastructure. You successfully performed a zone transfer against their primary name server and retrieved the entire zone file. Which immediate action should you take to minimize the risk of this being exploited by an attacker?
Select an answer first
33application · medium
A penetration tester is tasked with gathering email addresses for a social engineering test. The target company has a website with a blog, a LinkedIn page, and a public GitHub repository. Which combination of methods would be most effective for harvesting email addresses?
Select an answer first
34foundation · easy
What information can be obtained from analyzing email headers?
Select an answer first
35application · medium
You are using nslookup to enumerate DNS records for a target domain. You want to find all mail servers and also verify the authoritative name servers. Which set of nslookup commands would accomplish both tasks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.