Q: 6
You are performing a penetration test for a client and have gained shell access to a Windows
machine on the internal network. You intend to retrieve all DNS records for the internal domain, if
the DNS server is at 192.168.10.2 and the domain name is abccorp.local, what command would you
type at the nslookup prompt to attempt a zone transfer?
Options
Discussion
Why does everyone focus on option B's typo instead of how CEH structures these? Kinda feels like they just want close syntax, not perfect Windows commands.
B , even though it's got a typo (should be
ls -d), that's how you'd trigger an AXFR zone transfer in nslookup after connecting to the DNS server. A looks like a distractor. Pretty sure B is what CEH wants here.B or D
Leaning B since it's close to actual ls -d, but D looks tempting if you think they're after something zone specific. These CEH questions can be tricky with typos.
Leaning B since it's close to actual ls -d, but D looks tempting if you think they're after something zone specific. These CEH questions can be tricky with typos.
A , this syntax looked right to me based on some old exam sims. nslookup options are all over the place in CEH questions. Not 100% but I see A pop up in practice sets a lot too.
Probably B, but does the question assume you already switched to the DNS server with
server 192.168.10.2? That would matter here.B tbh, saw similar structuring in official courseware and practice exams. I'd check the EC-Council labs or their official guide if you want to double-check CEH expectations for nslookup zone transfer syntax.
B , even with the typo it’s closest to actual nslookup usage for a zone transfer (ls -d). I think CEH is after the structure not literal syntax. Not totally sure though, since real syntax matters on some exams.
B tbh, that's the right structure for nslookup zone transfer (should be
ls -d abccorp.local). Even with the typo, it's clear what they're testing for. Not 100% perfect syntax but definitely closest here.Be respectful. No spam.
