Objective 1.07 Identify DNS Security Concepts and Their Purpose [DDOS, DNSSEC, AnyCast, DNSFirewall, Site Validation, iRules, and Impacts of Floating self-IP Versus Non-Floating self-IP Listener] 302 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   How does a DNS firewall help prevent data exfiltration?

   • ABy encrypting all outbound DNS traffic
   • BBy validating DNSSEC signatures
   • CBy rate-limiting DNS queries
   • DBy blocking DNS queries to command-and-control domains
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security operations team notices that a workstation on the corporate network is making DNS queries to a domain that is known to be a command-and-control (C2) server. They want to prevent the workstation from resolving that domain and also prevent any other infected hosts from using DNS to exfiltrate data. Which control should they implement?

   • ADeploy AnyCast for the corporate DNS servers to improve their availability
   • BEnable DNSSEC validation on the recursive resolver to reject queries to unsigned domains
   • CIncrease the TTL on the malicious domain's records to cache the block
   • DConfigure a DNS firewall on the recursive resolver to block queries to the malicious domain and other known-bad domains
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of DNSSEC?

   • ATo block malicious domains
   • BTo speed up DNS resolution
   • CTo ensure DNS responses are authentic and unmodified
   • DTo encrypt DNS queries and responses
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the purpose of using iRules for DNS?

   • ATo customize DNS behavior for security and traffic management
   • BTo replace the need for DNSSEC
   • CTo encrypt all DNS traffic
   • DTo automatically block all DDoS attacks
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a security consideration when using a non-floating self-IP for a DNS listener?

   • AIt may become unavailable if the device fails
   • BIt can only be accessed from the local network
   • CIt is automatically more secure because it is not shared
   • DIt cannot be used for DNS traffic
   Reveal Solution Discussion Select an answer first