Whois, DNS and Email Footprinting CEH Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   In a Whois record, which field typically indicates the organization or individual that owns the domain?

   • ARegistrant
   • BRegistrar
   • CCreation Date
   • DName Server
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   You are investigating a spear-phishing email that was sent to multiple employees. The email contains an embedded image that is loaded from an external URL. The image URL is unique for each recipient. You notice that the email was opened by several recipients, and the external server logged their IP addresses. What is the most likely purpose of using unique image URLs?

   • ATo verify that the recipient's email address is valid
   • BTo track which recipients opened the email and their IP addresses
   • CTo encrypt the email content for each recipient
   • DTo bypass email filters by making each email appear different
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   You have discovered an IP address (203.0.113.45) during a penetration test. You want to find out which hostname resolves to this IP address to identify the server's role. Which DNS query should you perform?

   • AA reverse DNS lookup (PTR query)
   • BAn MX query for the IP address
   • CA forward DNS lookup for the IP address
   • DA zone transfer request for the IP address
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A security analyst is reviewing a Whois record for a domain and sees the following fields: Registrar: Example Registrar Inc. Creation Date: 2015-03-15 Expiration Date: 2025-03-15 Name Servers: ns1.examplehost.com, ns2.examplehost.com Registrant Organization: Example Corp. What can the analyst infer from this record?

   • AThe domain is registered to Example Corp. and uses Example Registrar as its hosting provider.
   • BThe domain is about to expire and will be deleted soon.
   • CThe domain was registered through Example Registrar Inc. and is hosted on Example Host's infrastructure.
   • DThe domain was created in 2015 and has been continuously renewed.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A penetration tester is attempting to enumerate all DNS records for a target domain. The tester has identified the authoritative name server and attempts a zone transfer, but the server does not respond to the AXFR request. The tester then tries a different approach: querying for common subdomains (e.g., www, mail, ftp) using 'dig'. This approach is known as brute-force subdomain enumeration. Why might this approach be more successful than a zone transfer?

   • ABrute-force enumeration does not require the name server to allow zone transfers, and it queries individual records that are often publicly resolvable.
   • BBrute-force enumeration is faster than a zone transfer because it queries multiple records simultaneously.
   • CBrute-force enumeration uses a different DNS protocol that bypasses security controls.
   • DBrute-force enumeration is more likely to succeed because it queries the recursive resolver instead of the authoritative server.
   Reveal Solution Discussion Select an answer first