312-50 Question 57
Single answer▪ Footprinting CountermeasuresA financial services company discovers during a red-team exercise that attackers were able to build a detailed profile of its external infrastructure before launching any active scans. The attackers used public DNS records to enumerate hosts, queried WHOIS data to identify key contacts, and searched cached web content to map legacy subdomains. The security team wants to reduce this exposure without breaking public-facing services such as email and the corporate website. Which action is the MOST effective footprinting countermeasure in this scenario?
- A
Configure split-horizon DNS, remove unnecessary public DNS records, and ensure domain registration uses privacy-protected or role-based contact information
- B
Disable DNS entirely on the public-facing domain and require users to connect only by IP address
- C
Block ICMP at the firewall so attackers cannot gather DNS, WHOIS, or cached website information
- D
Rename the company’s public website files and directories so search engines cannot index them
Show answer and explanation
Correct answer: A
Explanation
The scenario focuses on passive footprinting: DNS enumeration, WHOIS/contact intelligence gathering, and search-engine or cached-content analysis. Effective countermeasures should reduce publicly exposed metadata while preserving required Internet-facing services. In practice, organizations commonly use split-horizon DNS, restrict zone transfer, minimize public DNS entries to only those necessary, avoid publishing unnecessary hostnames, and use generic or privacy-protected registration contacts where policy and registrar rules permit. For web exposure, controlling indexing with appropriate directives and removing obsolete public content is more effective than simply renaming files. These approaches align with common defensive guidance from DNS and registrar operational best practices, as well as general attack surface reduction principles emphasized in CEH footprinting countermeasures.
- A. Correct.
Correct. This is the most effective and realistic countermeasure set for the scenario. Split-horizon DNS helps ensure internal naming information is not exposed externally, while removing unnecessary public DNS records reduces the amount of host data available through passive enumeration. Using privacy-protected registration where appropriate, or role-based contact details instead of named individuals, reduces intelligence leakage through WHOIS and related registration data. These measures directly address the identified footprinting vectors without disrupting legitimate public services like web and email.
- B. Incorrect.
Incorrect. Disabling public DNS would break normal Internet access to the company’s website and email services because users and mail servers rely on DNS resolution. This option reflects a common misconception that eliminating a service entirely is a practical security control. In reality, the goal is to minimize exposed information while maintaining business functionality.
- C. Incorrect.
Incorrect. Blocking ICMP may reduce certain forms of host discovery, but it does not prevent passive footprinting through public DNS records, domain registration data, or search engine caches. This is a plausible distractor because ICMP filtering is often associated with reducing reconnaissance, but it does not address the specific information sources described in the scenario.
- D. Incorrect.
Incorrect. Renaming website files and directories does not meaningfully prevent search engines or attackers from indexing or discovering public content. Search engines crawl links and content made available over HTTP/HTTPS, and cached historical content can still remain accessible unless proper removal processes are followed. This option confuses obscurity with a true footprinting countermeasure.