Objective 1.07 Identify DNS Security Concepts and Their Purpose [DDOS, DNSSEC, AnyCast, DNSFirewall, Site Validation, iRules, and Impacts of Floating self-IP Versus Non-Floating self-IP Listener] 302 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which technique is commonly used to mitigate volumetric DNS DDoS attacks?

   • ADNSSEC signing of all zone records
   • BUsing a single, high-capacity DNS server
   • CDisabling recursion on authoritative servers
   • DRate limiting and traffic filtering
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A financial services firm is concerned about a man-in-the-middle attacker who could intercept DNS responses and redirect users to a fraudulent website. They already have a DNS firewall in place to block known malicious domains. What additional control should they implement to ensure that the DNS responses themselves have not been tampered with in transit?

   • AConfigure the DNS firewall to block all queries from outside the corporate network
   • BDeploy DNSSEC to digitally sign the zone data so resolvers can verify the authenticity and integrity of the responses
   • CEnable rate limiting on the DNS server to drop responses that arrive too quickly
   • DIncrease the TTL on all DNS records to reduce the number of queries that need to be sent
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of DNS DDoS protection?

   • ATo authenticate the source of DNS queries
   • BTo filter out malicious domain names in DNS responses
   • CTo ensure DNS servers remain available during volumetric attacks
   • DTo encrypt DNS queries and responses to prevent eavesdropping
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is an example of using an iRule for DNS security?

   • AAutomatically creating DNS records
   • BBlocking DNS queries from specific source IPs
   • CSigning DNS zones with DNSSEC
   • DEncrypting DNS traffic with TLS
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company uses BIG-IP DNS to load balance between two data centers. They have configured site validation using an HTTP monitor. They also use a DNS iRule to customize responses based on the client's location. During a failover, the monitor correctly marks the primary site as down, but the iRule is still returning the primary site's IP address to clients in a specific region. What is the most likely cause?

   • AThe iRule is overriding the load balancing decision made by the BIG-IP DNS server
   • BThe DNS firewall is blocking the monitor's health check, so the site is not actually marked down
   • CDNSSEC is not enabled, so the iRule cannot validate the response
   • DThe AnyCast address is not configured, so the iRule cannot determine the correct site
   Reveal Solution Discussion Select an answer first