Objective 2.13 Explain How to Verify That DNSSEC Is Working 302 Practice Questions (Page 4)

Questions 16–18

1. 16application · medium

   A BIG-IP DNS admin has placed DNSSEC signature files for the zone example.org in `/config/dns/keys/`. The zone loads, but queries return no RRSIGs. What should the admin do to fix this?

   • ARestart the DNS service to force it to re-read the key directory.
   • BRename the `.sig` files to `.key` so the server recognizes them.
   • CCreate a symlink from `/config/dns/keys/` to the zone directory.
   • DMove the `.sig` files to the zone's data directory, such as `/config/dns/zones/`.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A BIG-IP DNS admin has a signed zone that was working. After a system update, the zone loads but returns no RRSIGs. The admin checks the zone directory and finds the `.sig` files are present but have the wrong ownership. What is the most likely cause?

   • AThe zone was not signed before the update.
   • BThe client is not sending the DO bit.
   • CThe DNS server process cannot read the `.sig` files due to incorrect permissions.
   • DThe DNS server is not authoritative for the zone.
   Reveal Solution Discussion Select an answer first
3. 18expert · hard

   An admin is verifying DNSSEC on a BIG-IP DNS server that is authoritative for a signed zone. They query the server directly and receive a response with the AA bit set and an RRSIG. However, when they query the same zone through a recursive resolver, the response has the AD bit set but no RRSIG. What does this indicate?

   • AThe authoritative server is not signing the zone correctly.
   • BThe zone is not signed and the RRSIG was a fluke.
   • CThe recursive resolver validated the response and stripped the RRSIG from the answer.
   • DThe recursive resolver is not configured to validate DNSSEC.
   Reveal Solution Discussion Select an answer first