312-50V10 Question #656: Real Exam Question with Answer & Explanation

The correct answer is D: To illicit a response back that will reveal information about email servers and how they treat. Sending email to a known-invalid address triggers a Non-Delivery Report (NDR) bounce that often reveals mail server software names, version numbers, and internal relay paths useful for reconnaissance.

Question

Why would you consider sending an email to an address that you know does not exist within the company you are performing a Penetration Test for?

Options

ATo determine who is the holder of the root account
BTo perform a DoS
CTo create needless SPAM
DTo illicit a response back that will reveal information about email servers and how they treat
ETo test for virus protection

Explanation

Sending email to a known-invalid address triggers a Non-Delivery Report (NDR) bounce that often reveals mail server software names, version numbers, and internal relay paths useful for reconnaissance.

Common mistakes.

A. NDR bounce messages expose server configuration and software details - they have no mechanism to identify the owner of the root account.
B. A single message sent to one invalid address generates only a single bounce reply and cannot cause a denial of service condition.
C. Spam requires mass delivery to valid recipients - sending one message to a deliberately invalid address is a targeted recon technique, not spam generation.
E. Testing virus protection requires attaching files with known malware signatures; sending to an invalid address tests SMTP server behavior, not antivirus scanning.

Concept tested. SMTP NDR bounce message reconnaissance for server enumeration

Reference. https://www.rfc-editor.org/rfc/rfc5321

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice