312-50 Question 55
Single answer▪ Footprinting CountermeasuresA company discovers that external attackers are gathering detailed information about its internal network by combining public DNS data, WHOIS records, and email addresses harvested from employee-facing web pages. As part of a footprinting countermeasure project, the security team wants to reduce publicly exposed reconnaissance data without disrupting normal Internet services such as email delivery and website access. Which action is the MOST effective first step?
- A
Review and minimize publicly available DNS and domain registration data, including restricting zone transfers and removing unnecessary contact details from WHOIS where allowed
- B
Disable the organization's public website so attackers cannot scrape employee names and email addresses
- C
Block all ICMP traffic at the perimeter firewall to prevent any future footprinting attempts
- D
Move the corporate mail server behind NAT so external users cannot identify the mail infrastructure
Show answer and explanation
Correct answer: A
Explanation
The best answer is to reduce unnecessary public information exposure at the sources being used for footprinting. In practice, this means hardening public DNS configuration, especially by preventing unauthorized zone transfers, reviewing exposed records, and minimizing sensitive or overly specific registration and contact details in domain records where registrar and regulatory rules permit. Organizations should also replace personal email addresses on public pages with generic role accounts when possible. These actions preserve essential Internet functionality while reducing reconnaissance value.
Relevant best practices include restricting DNS zone transfers to authorized secondary name servers, limiting public-facing metadata, and applying data minimization to public contact information. Guidance from sources such as ICANN registrar practices, DNS server vendor documentation, and general security hardening recommendations from organizations like CISA and NIST supports minimizing exposed administrative details and securing DNS operations. In a CEH context, footprinting countermeasures focus on reducing publicly accessible intelligence rather than relying on disruptive measures such as shutting down services.
- A. Correct.
Correct. This directly addresses the specific footprinting sources mentioned in the scenario: DNS, WHOIS, and public contact information. Restricting DNS zone transfers to authorized secondary servers, limiting unnecessary DNS record exposure, and using privacy-protecting or role-based registration contacts where permitted are practical countermeasures that reduce reconnaissance value while preserving normal public services. This is a standard and realistic first step because it targets information disclosure rather than trying to eliminate Internet-facing services.
- B. Incorrect.
Incorrect. Disabling the public website would be highly disruptive and is not a reasonable first step for most organizations. While reducing unnecessary employee details on public pages is a valid countermeasure, taking the entire site offline is not aligned with the requirement to preserve normal business services. The misconception is assuming the only way to stop scraping is to remove the service entirely rather than sanitize exposed content.
- C. Incorrect.
Incorrect. Blocking ICMP may reduce some network discovery techniques, but it does not meaningfully address the primary data sources in this scenario: DNS records, WHOIS data, and published email addresses. It can also interfere with legitimate troubleshooting and path MTU discovery depending on implementation. This option reflects the common mistake of focusing on network scanning defenses when the exposure is mainly from publicly published information.
- D. Incorrect.
Incorrect. NAT does not prevent external identification of mail infrastructure because public email delivery typically relies on DNS MX records that must remain reachable. Attackers performing footprinting usually learn mail infrastructure from DNS, headers, and mail exchanges, not from internal address visibility alone. This option confuses address translation with information-hiding in public-facing service design.