Objective 1.07 Identify DNS Security Concepts and Their Purpose [DDOS, DNSSEC, AnyCast, DNSFirewall, Site Validation, iRules, and Impacts of Floating self-IP Versus Non-Floating self-IP Listener] 302 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company uses BIG-IP DNS to load balance traffic between two data centers. They have configured site validation using an HTTP monitor. During a failover test, they notice that the monitor is reporting the primary site as down, but the web application is actually healthy. What is the most likely cause of this false positive?

   • AThe DNS firewall is blocking the monitor's health check requests
   • BThe AnyCast address is not configured on the web server
   • CThe zone is not signed with DNSSEC, so the monitor cannot validate the response
   • DThe monitor is configured with a timeout that is too short for the application's normal response time
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a key benefit of using AnyCast for DNS servers?

   • AIt provides a single point of management
   • BIt increases resilience against DDoS attacks
   • CIt eliminates the need for DNSSEC
   • DIt ensures all queries are answered by the same server
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A service provider wants to provide a custom DNS response to queries for a specific domain based on the source IP of the client. For example, clients from a particular country should receive a different A record than clients from other countries. They also want to log all queries for this domain for security analysis. Which BIG-IP DNS feature should they use?

   • AUse AnyCast to route clients from the specific country to a different DNS server
   • BEnable DNSSEC signing on the zone to ensure the custom responses are authentic
   • CConfigure a DNS firewall policy to block the domain for clients from the specific country
   • DWrite a DNS iRule that inspects the client's source IP and returns a customized A record, and logs the query
   Reveal Solution Discussion Select an answer first
5. 4application · hard

   A company wants to use a DNS iRule to drop queries for a specific domain that is being used for data exfiltration. They also want to ensure that the iRule does not interfere with DNSSEC validation for other domains. What should they consider when writing the iRule?

   • AThe iRule should disable DNSSEC validation for all queries to ensure the iRule can process them
   • BThe iRule should use the DNS firewall to block the domain instead of returning a REFUSED response
   • CThe iRule should inspect the DNS query type and name, and return a REFUSED response for the malicious domain while allowing all other queries to pass through normally
   • DThe iRule should be applied to the authoritative virtual server only, so it does not affect recursive queries
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company is deploying DNSSEC for their authoritative zone. They also use a DNS firewall to block malicious domains. They notice that some legitimate queries are being dropped by the DNS firewall, and they suspect it is because the firewall is inspecting DNSSEC-related record types. What is the most likely cause of the issue?

   • AThe DNSSEC signing key is not published in the zone, so the firewall cannot validate the records
   • BThe iRules are not configured to allow DNSSEC traffic through the firewall
   • CThe DNS firewall policy is configured to block DNSKEY, RRSIG, or DS record types, which are required for DNSSEC validation
   • DThe AnyCast address for the DNS server is not configured, so the firewall cannot process the queries
   Reveal Solution Discussion Select an answer first