Objective 2.13 Explain How to Verify That DNSSEC Is Working 302 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An admin is verifying that DNSSEC is working on a BIG-IP DNS server. They query the server for the A record of `www.example.com` and receive a response with the AA bit set and an RRSIG record. What additional check should they perform to confirm the signature is valid?

   • ACheck that the TTL of the RRSIG is greater than the TTL of the A record.
   • BEnsure the response has the AD bit set.
   • CConfirm the response has the CD bit set.
   • DVerify that the RRSIG's signer name matches the zone name and the key tag matches a published DNSKEY.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A BIG-IP DNS admin has generated DNSSEC key pairs and signature files for the zone example.net. The zone loads without errors, but external queries return no RRSIGs. The admin checks the file system and finds the `.key` files in `/config/dns/keys/` but the `.sig` files are missing. What is the most likely cause?

   • AThe signature files were placed in the wrong directory and the DNS server cannot find them.
   • BThe `.sig` files are stored in the same directory as the `.key` files by default.
   • CThe zone is signed but the signatures expired and were automatically deleted.
   • DThe `.sig` files are only generated when the zone is transferred to a secondary server.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   On a BIG-IP DNS server, where should DNSSEC signature files (e.g., .sig files) be stored so that the system can properly use them for zone signing?

   • A/var/named/
   • B/config/dnssec/
   • C/var/tmp/
   • D/etc/named/
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company has a signed zone on BIG-IP DNS. They recently rolled the ZSK (Zone Signing Key). After the rollover, external clients report validation failures. The admin queries the authoritative server directly and sees RRSIGs, but the signatures are for the old ZSK. What is the most likely cause?

   • AThe DNSKEY record for the new ZSK was not published.
   • BThe client resolvers are not configured to validate.
   • CThe zone was not re-signed with the new ZSK after the rollover.
   • DThe `.sig` files were deleted during the rollover.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A BIG-IP DNS admin is troubleshooting why a signed zone is not returning RRSIGs. They confirm the `.sig` files are in the correct directory and the zone loads. They query the server directly with `dig example.com SOA +dnssec` and see the AA bit set but no RRSIG. What should they check next?

   • AEnsure the client's resolver is set to validate DNSSEC.
   • BCheck that the query was sent to a recursive resolver instead of the authoritative server.
   • CVerify that the DNSKEY records are published in the zone and that the signing key is active.
   • DConfirm that the `.sig` files are named exactly as the zone expects.
   Reveal Solution Discussion Select an answer first