Objective 1.07 Identify DNS Security Concepts and Their Purpose [DDOS, DNSSEC, AnyCast, DNSFirewall, Site Validation, iRules, and Impacts of Floating self-IP Versus Non-Floating self-IP Listener] 302 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In DNS failover, what role does site validation play?

   • AIt encrypts traffic between sites
   • BIt determines which site has the fastest response time
   • CIt triggers a failover when a site becomes unhealthy
   • DIt ensures all sites have the same content
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   How does AnyCast improve DNS availability?

   • ABy routing queries to the nearest available server
   • BBy using a load balancer to distribute queries
   • CBy storing DNS records on a single server
   • DBy encrypting all DNS traffic
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of a DNS firewall?

   • ATo provide DNSSEC validation
   • BTo encrypt DNS queries
   • CTo block DNS queries to known malicious domains
   • DTo speed up DNS resolution
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A large enterprise runs authoritative DNS from two data centers. They are experiencing a volumetric DDoS attack that is saturating the network link at one data center. They have AnyCast configured for the DNS service, and the DNS listeners use floating self-IPs. However, the attack is still causing service degradation. What is the most likely reason the AnyCast deployment is not fully mitigating the attack?

   • AThe iRules are not configured to rate-limit the attack traffic
   • BThe attack is targeting the floating self-IP, which is only advertised from one data center at a time
   • CDNSSEC is not enabled, so the server cannot validate the queries and drops them
   • DThe DNS firewall is not configured to block the attack traffic
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company runs a web application in two data centers. They use BIG-IP DNS to load balance traffic between the two sites. They want to ensure that if one site's web server is returning HTTP 500 errors, BIG-IP DNS stops sending new user traffic to that site and directs all traffic to the healthy site. Which feature should they configure?

   • ADeploy AnyCast for the web application's IP address so the network can route around the unhealthy site
   • BConfigure a DNS firewall to block queries that resolve to the unhealthy site
   • CEnable DNSSEC on the zone to ensure the DNS responses are authentic
   • DConfigure site validation (monitors) on the BIG-IP DNS server to check the health of the web application and update the load balancing decision
   Reveal Solution Discussion Select an answer first