A company has publicly hosted web applications and an internal Intranet protected by a firewall. Which technique will help protect against enumeration?

Rejecting invalid SMTP email is a mail hygiene measure that reduces spam and spoofing risk, but has no effect on DNS-based or network enumeration of internal hosts.

Allowing full DNS zone transfers exposes the complete set of DNS records to any requesting party, which dramatically increases enumeration risk rather than mitigating it.

DNS enumeration allows attackers to discover internal hostnames and IP addresses by querying A records, which can reveal the intranet structure and identify potential targets for further attacks. By removing A records for internal hosts from any publicly accessible DNS zone, the organization ensures that external queries return no usable mapping of the internal network. This is a foundational DNS hardening practice that directly limits reconnaissance against protected intranet resources.

Enabling null session pipes permits unauthenticated NetBIOS connections that can be used to enumerate Windows shares, users, and group memberships, which increases enumeration exposure rather than reducing it.