nerdexam
EC-Council

312-50V13 · Question #173

You are performing a penetration test for a client and have gained shell access to a Windows machine on the internal network. You intend to retrieve all DNS records for the internal domain, if the DNS

The correct answer is B. is-d abccorp.local. To attempt a DNS zone transfer for a domain from a specific server using the nslookup utility, the command ls -d <domain_name> is used after setting the server.

Submitted by satoshi_tk· Mar 6, 2026Enumeration

Question

You are performing a penetration test for a client and have gained shell access to a Windows machine on the internal network. You intend to retrieve all DNS records for the internal domain, if the DNS server is at 192.168.10.2 and the domain name is abccorp.local, what command would you type at the nslookup prompt to attempt a zone transfer?

Options

  • Alist server=192.168.10.2 type=all
  • Bis-d abccorp.local
  • CIserver 192.168.10.2-t all
  • DList domain=Abccorp.local type=zone

How the community answered

(22 responses)
  • A
    5% (1)
  • B
    91% (20)
  • C
    5% (1)

Why each option

To attempt a DNS zone transfer for a domain from a specific server using the `nslookup` utility, the command `ls -d <domain_name>` is used after setting the server.

Alist server=192.168.10.2 type=all

This syntax is incorrect for `nslookup` zone transfer; `list` is not a standard `nslookup` command for this purpose, and the parameter format is wrong.

Bis-d abccorp.localCorrect

Within the `nslookup` utility, after first setting the target DNS server (e.g., `server 192.168.10.2`), the command `ls -d abccorp.local` is the correct syntax to request a zone transfer for the specified domain. This command attempts to list all resource records for the zone from the configured DNS server.

CIserver 192.168.10.2-t all

This syntax is incorrect; `lserver` with `-t all` is not a valid `nslookup` command for zone transfers. `lserver` is used to specify the server, and `-t` for query type, but not for a zone transfer in this manner.

DList domain=Abccorp.local type=zone

This syntax is incorrect for `nslookup` zone transfer; `List` with `domain=` and `type=zone` are not valid parameters for this operation in `nslookup`.

Concept tested: nslookup zone transfer command

Source: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/nslookup

Topics

#DNS zone transfer#Nslookup#Network reconnaissance#Windows command line

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V13 Practice