DNS cache snooping technique used during enumeration

312-50v12 By islever Editorial Last updated

Enumeration Foot Printing and Reconnaissance

Short answer

B Henry uses DNS cache snooping to query the organization's DNS resolver cache and infer the sites users recently visited.

Question

Henry is a penetration tester who works for XYZ organization. While performing enumeration on a client organization, he queries the DNS server for a specific cached DNS record. Further, by using this cached record, he determines the sites recently visited by the organization's user. What is the enumeration technique used by Henry on the organization?
  1. DNS zone walking
  2. DNS cache snooping Correct Answer
  3. DNS cache poisoning
  4. DNSSEC zone walking

Key Takeaways

The question tests whether you can distinguish passive reconnaissance against a DNS resolver's cache from active attacks: reading cached lookups reveals recent user browsing (snooping), while poisoning falsifies records and zone walking enumerates DNSSEC/NSEC zone contents.

This CEH scenario describes a tester querying a DNS resolver's cache to discover which domains an organization's users recently resolved, which is the definition of DNS cache snooping. The page confirms that cache snooping, not zone walking or cache poisoning, is the passive enumeration technique being tested here.

Common mistake: All distractors were picked by nobody, but the classic confusion is DNS cache poisoning (option C): learners assume the word 'cache' implies an attack that corrupts it, when Henry only reads cached records and never modifies them.

Expert Analysis

Why the Answer Is Correct

Henry queries the DNS server for records already sitting in its cache and infers recently visited sites from those cached entries, which is exactly DNS cache snooping — a passive enumeration step that harvests user activity without altering anything. Because the resolver caches answers on behalf of internal clients, the presence of a cached record for a domain proves that someone inside the organization recently resolved it. This maps directly to CEH module material on enumeration, where cache snooping is listed alongside zone transfers and SNMP enumeration as a way to fingerprint user behavior and internal naming conventions.

Why the Other Options Are Wrong

DNS zone walking (A) and DNSSEC zone walking (D) mean enumerating all records in a DNS zone, typically by exploiting NSEC chains in DNSSEC-signed zones; that yields the zone's record set, not evidence of which sites users browsed. DNS cache poisoning (C) is an active man-in-the-middle attack that injects forged responses into a resolver cache to redirect clients, and it corrupts data rather than reading it — Henry performs no injection. Since no forgery and no full-zone enumeration occurs, only cache snooping fits the described behavior.

Community Comment Notes

Commenters unanimously selected B, and insaniunt's explanation captures the mechanism precisely: 'This technique involves querying the DNS server's cache for information about the recent DNS resolutions it has performed.' LordXander corroborates by citing the corresponding curriculum, writing 'B - CEH 470 / Module 4', which confirms the official exam-source placement of this technique under enumeration.

Exam Strategy

Watch for the verbs 'query/read' versus 'inject/alter': passive reading of resolver cache = snooping, active insertion = poisoning, full-record enumeration = zone walking. On CEH exam items, the phrase 'recently visited sites' is a strong keyword signature for DNS cache snooping.

Frequently Asked Questions

Why isn't DNS cache poisoning the right answer if Henry is reading the resolver cache?

Poisoning means injecting forged responses to redirect clients, an active attack. Henry only reads cached records to learn browsing history, so it is snooping.

How is DNS zone walking different from DNS cache snooping?

Zone walking enumerates every record in a DNS zone (often via DNSSEC NSEC chains). Snooping instead inspects cached lookups to reveal which domains users recently resolved.

More 312-50v12 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. insaniunt 👍 6 Answered B
    DNS Cache Snooping: This technique involves querying the DNS server's cache for information about the recent DNS resolutions it has performed. By analyzing the cached records, an attacker can gain insights into the websites or services recently visited by the organization's users. This can be a valuable reconnaissance step in understanding the organization's network activity.
  2. qtygbapjpesdayazko 👍 1
    Could someone please validate this information
  3. LordXander 👍 2 Answered B
    B - CEH 470 / Module 4

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide