DNS cache snooping technique used during enumeration
Henry is a penetration tester who works for XYZ organization. While performing enumeration on a client organization, he queries the DNS server for a specific cached DNS record. Further, by using this cached record, he determines the sites recently visited by the organization's user. What is the enumeration technique used by Henry on the organization?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests whether you can distinguish passive reconnaissance against a DNS resolver's cache from active attacks: reading cached lookups reveals recent user browsing (snooping), while poisoning falsifies records and zone walking enumerates DNSSEC/NSEC zone contents.
This CEH scenario describes a tester querying a DNS resolver's cache to discover which domains an organization's users recently resolved, which is the definition of DNS cache snooping. The page confirms that cache snooping, not zone walking or cache poisoning, is the passive enumeration technique being tested here.
All distractors were picked by nobody, but the classic confusion is DNS cache poisoning (option C): learners assume the word 'cache' implies an attack that corrupts it, when Henry only reads cached records and never modifies them.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Henry queries the DNS server for records already sitting in its cache and infers recently visited sites from those cached entries, which is exactly DNS cache snooping — a passive enumeration step that harvests user activity without altering anything. Because the resolver caches answers on behalf of internal clients, the presence of a cached record for a domain proves that someone inside the organization recently resolved it. This maps directly to CEH module material on enumeration, where cache snooping is listed alongside zone transfers and SNMP enumeration as a way to fingerprint user behavior and internal naming conventions.Why the Other Options Are Wrong
DNS zone walking (A) and DNSSEC zone walking (D) mean enumerating all records in a DNS zone, typically by exploiting NSEC chains in DNSSEC-signed zones; that yields the zone's record set, not evidence of which sites users browsed. DNS cache poisoning (C) is an active man-in-the-middle attack that injects forged responses into a resolver cache to redirect clients, and it corrupts data rather than reading it — Henry performs no injection. Since no forgery and no full-zone enumeration occurs, only cache snooping fits the described behavior.Community Comment Notes
Commenters unanimously selected B, and insaniunt's explanation captures the mechanism precisely: 'This technique involves querying the DNS server's cache for information about the recent DNS resolutions it has performed.' LordXander corroborates by citing the corresponding curriculum, writing 'B - CEH 470 / Module 4', which confirms the official exam-source placement of this technique under enumeration.Exam Strategy
Watch for the verbs 'query/read' versus 'inject/alter': passive reading of resolver cache = snooping, active insertion = poisoning, full-record enumeration = zone walking. On CEH exam items, the phrase 'recently visited sites' is a strong keyword signature for DNS cache snooping.
Frequently Asked Questions
Why isn't DNS cache poisoning the right answer if Henry is reading the resolver cache?
Poisoning means injecting forged responses to redirect clients, an active attack. Henry only reads cached records to learn browsing history, so it is snooping.
How is DNS zone walking different from DNS cache snooping?
Zone walking enumerates every record in a DNS zone (often via DNSSEC NSEC chains). Snooping instead inspects cached lookups to reveal which domains users recently resolved.