Henry is a penetration tester who works for XYZ organization. While performing enumeration on a client organization, he queries the DNS server for a specific cached DNS record. Further, by using this

DNS zone walking iterates through DNS zone records by exploiting NSEC record chaining in DNSSEC-signed zones to enumerate all hostnames in a zone, not querying cached resolver records for browsing activity.

DNS cache snooping is a closely related but distinct passive technique that infers recently visited sites by observing TTL values of cached records without injecting or modifying any data.

DNSSEC zone walking specifically abuses NSEC records in DNSSEC-protected zones to enumerate domain names sequentially, and is unrelated to reading a resolver's cache to profile user activity.

In this enumeration context, DNS cache poisoning describes an attacker interacting with a DNS server's cache to extract stored records that reflect recent user activity. By querying these cached entries, Henry passively profiles the organization's browsing patterns and internet-facing infrastructure without triggering active alerts on the target network.