Objective 1.07 Identify DNS Security Concepts and Their Purpose [DDOS, DNSSEC, AnyCast, DNSFirewall, Site Validation, iRules, and Impacts of Floating self-IP Versus Non-Floating self-IP Listener] 302 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which security property does DNSSEC provide for DNS data?

   • AConfidentiality
   • BAvailability
   • CIntegrity and authenticity
   • DNon-repudiation
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A global e-commerce company runs authoritative DNS from two data centers. During a recent volumetric attack, one data center's DNS infrastructure was overwhelmed, causing resolution failures for customers worldwide. The company wants to distribute the attack load across both sites and ensure that queries continue to be answered even if one site is saturated. Which approach should they implement?

   • AEnable DNSSEC validation on the recursive resolvers to reject spoofed queries before they reach the authoritative servers
   • BPlace a DNS firewall in front of each data center to block all traffic that does not match a known good query pattern
   • CDeploy the DNS service on non-floating self-IPs and rely on the local DNS server's rate limiting
   • DConfigure AnyCast addressing so that the same DNS IP is advertised from both data centers, allowing the network to route queries to the closest or least-congested site
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company's authoritative DNS server is being targeted by a DNS amplification attack, where the attacker sends spoofed queries with a small source IP and the server responds with large responses, flooding the victim. The company wants to mitigate this attack on the BIG-IP DNS server itself. Which configuration should they implement?

   • AUse a non-floating self-IP for the DNS listener to isolate the server
   • BEnable rate limiting on the DNS listener to limit the number of responses sent to a single source IP
   • CConfigure DNSSEC signing on the zone to ensure the responses are authentic
   • DDeploy AnyCast for the DNS server IP to distribute the attack load
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the purpose of site validation in DNS load balancing?

   • ATo speed up DNS resolution
   • BTo verify that a site is available before sending traffic to it
   • CTo authenticate users
   • DTo encrypt DNS queries between sites
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A content delivery network operates authoritative DNS servers in 10 locations worldwide. They want to ensure that a DDoS attack targeting a single DNS server IP does not take down the entire service. They also want to minimize latency for users. Which deployment strategy best meets these requirements?

   • AAssign a unique unicast IP address to each DNS server and use a global load balancer to distribute queries
   • BUse a single AnyCast IP address advertised from all 10 locations
   • CConfigure each DNS server with a non-floating self-IP and rely on the local OS firewall to drop malicious packets
   • DDeploy a DNS firewall at each location to filter out attack traffic before it reaches the DNS server
   Reveal Solution Discussion Select an answer first