Exam 312-50v10 topic 1 question 73 discussion

Actual exam question from ECCouncil's 312-50v10

Question #: 73
Topic #: 1

DNS cache snooping is a process of determining if the specified resource address is present in the DNS cache records. It may be useful during the examination of the network to determine what software update resources are used, thus discovering what software is installed.
What command is used to determine if the entry is present in DNS cache?

A. nslookup -fullrecursive update.antivirus.com
B. dnsnooping ""rt update.antivirus.com
C. nslookup -norecursive update.antivirus.com
D. dns --snoop update.antivirus.com

Show Suggested Answer

Suggested Answer: C 🗳️

by TrendMicroDLPSSucks at July 16, 2020, 1:38 p.m.

Comments

Submit Cancel

TrendMicroDLPSSucks

10 months, 2 weeks ago

ecursive Query: Since the DNS server doesn’t have any knowledge about the hostname in the query, it will ask its own DNS server to resolve it. The recursive query thus always returns the IP address of the hostname if such an IP exists. Recursive queries are not required to be supported by DNS servers.

upvoted 3 times

...

TrendMicroDLPSSucks

10 months, 2 weeks ago

Non-Recursive Query: If the DNS server doesn’t have any knowledge about the hostname in the query, it returns a list of DNS servers, which might have such information. But if the hostname-IP pair is in the local cache, the corresponding IP is returned. Non-recursive queries must be supported by all DNS servers.

upvoted 3 times

...