A tester gains initial access to a server and needs to enumerate all corporate domain DNS records. Which of the following commands should the tester use?

The correct answer is C. dig axfr @local.dns.server. The dig axfr @local.dns.server command attempts a DNS zone transfer, which retrieves all DNS records for a domain if misconfigured permissions allow it. This is a common enumeration technique used to extract subdomains, mail servers, and other domain-related

Submitted by khalil_dz· Mar 6, 2026Reconnaissance and enumeration

Question

Options

Adig +short A AAAA local.domain
Bnslookup local.domain
Cdig axfr @local.dns.server
Dnslookup -server local.dns.server local.domain *

How the community answered

(39 responses)

A
5% (2)
B
3% (1)
C
90% (35)
D
3% (1)

Explanation

The dig axfr @local.dns.server command attempts a DNS zone transfer, which retrieves all DNS records for a domain if misconfigured permissions allow it. This is a common enumeration technique used to extract subdomains, mail servers, and other domain-related

Topics

#DNS enumeration#DNS zone transfer#dig command

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice