Certified Ethical Hacker (CEH v10) — Question 48

DNS cache snooping is a process of determining if the specified resource address is present in the DNS cache records. It may be useful during the examination of the network to determine what software update resources are used, thus discovering what software is installed.
What command is used to determine if the entry is present in DNS cache?

Answer options

• A. nslookup -fullrecursive update.antivirus.com
• B. dnsnooping ""rt update.antivirus.com
• C. nslookup -norecursive update.antivirus.com
• D. dns --snoop update.antivirus.com

Correct answer: C

Explanation

The correct answer is C, as the 'nslookup -norecursive' command allows the user to query a DNS server without asking it to perform a recursive lookup, which is essential for checking the DNS cache. Option A performs a full recursive lookup, which is not suitable for cache checking, while B contains a syntax error and option D is not a valid command.