What risk is associated with misconfiguring DNS zone transfers?

• A. All DNS records are hidden.
• B. Exposes all DNS zone data for the domain.
• C. Query performance increases.
• D. It causes DNS to stop resolving.

Answer: (B)

DNS zone transfers are meant to copy the DNS zone data to trusted secondary servers. When this capability is misconfigured to permit transfers to any host, an attacker can perform a zone transfer and retrieve the entire zone data. That means every record in the domain—hostnames, IP mappings, subdomains, mail servers, and other records—becomes exposed, giving a complete map of the domain’s infrastructure for reconnaissance or exploitation. The risk isn’t that records are hidden or that performance improves; it’s that the entire DNS zone data is exposed to anyone who requests it, which is why this misconfiguration is a serious security flaw.