nerdexam
EC-Council

312-50V13 · Question #582

As a Certified Ethical Hacker, you are conducting a footprinting and reconnaissance operation against a target organization. You discover a range of IP addresses associated with the target using the…

The correct answer is C. dnsrecon -r 162.241.216.0/24 -n nsl.example.com -t std. The dnsrecon -t std command is most effective for performing reverse DNS lookups and enumerating nameserver and MX records for a given IP range.

Submitted by zhang_li· Mar 6, 2026Footprinting and Reconnaissance

Question

As a Certified Ethical Hacker, you are conducting a footprinting and reconnaissance operation against a target organization. You discover a range of IP addresses associated with the target using the SecurityTrails tool. Now, you need to perform a reverse DNS lookup on these IP addresses to find the associated domain names, as well as determine the nameservers and mail exchange (MX) records. Which of the following DNSRecon commands would be most effective for this purpose?

Options

  • Adnsrecon -r 192.168.1.0/24 -n nsl.example.com -t axfr
  • Bdnsrecon -r 10.0.0.0/24 -n nsl.example.com -t zonewalk
  • Cdnsrecon -r 162.241.216.0/24 -n nsl.example.com -t std
  • Ddnsrecon -r 162.241.216.0/24 -d example.com -t brt

How the community answered

(35 responses)
  • A
    9% (3)
  • B
    3% (1)
  • C
    83% (29)
  • D
    6% (2)

Why each option

The `dnsrecon -t std` command is most effective for performing reverse DNS lookups and enumerating nameserver and MX records for a given IP range.

Adnsrecon -r 192.168.1.0/24 -n nsl.example.com -t axfr

`192.168.1.0/24` is a private IP range, making it unsuitable for public target reconnaissance, and the `axfr` type is for zone transfers, not general enumeration of multiple record types.

Bdnsrecon -r 10.0.0.0/24 -n nsl.example.com -t zonewalk

`10.0.0.0/24` is also a private IP range, and while `zonewalk` attempts to discover hosts, it might not comprehensively cover all the requested record types as efficiently as `std` for broad information gathering.

Cdnsrecon -r 162.241.216.0/24 -n nsl.example.com -t stdCorrect

The `dnsrecon -t std` command performs standard enumeration of a given range (`-r`) and can query specific name servers (`-n`). The 'std' type typically includes requests for various record types like A, AAAA, NS, SOA, MX, SRV, and PTR (for reverse DNS), which directly aligns with the need to find associated domain names (via reverse lookup), nameservers (NS), and mail exchange (MX) records, using a valid public IP range.

Ddnsrecon -r 162.241.216.0/24 -d example.com -t brt

The `-d example.com` flag specifies the target *domain* for brute-forcing subdomains (`-t brt`), which is not the correct approach for performing reverse DNS lookups on an IP range.

Concept tested: DNSRecon command line usage for reconnaissance

Topics

#Footprinting#Reconnaissance#DNSRecon#Reverse DNS

Community Discussion

No community discussion yet for this question.

Full 312-50V13 Practice