A company runs a DNS server that is authoritative for its domain and also provides recursive resolution for employees. The server is currently configured with allow-recursion set to the internal network. A security audit recommends disabling recursion to reduce the attack surface. However, the company still needs internal recursive resolution. What is the best solution?

Set allow-recursion to any and rely on response rate limiting.

Keep recursion enabled but restrict allow-query to internal networks.

Run two separate BIND instances: one authoritative-only and one recursive for internal clients.

Set recursion no and rely on internal clients using external resolvers.

A DNS administrator is configuring response rate limiting (RRL) on an authoritative-only server. They want to mitigate amplification attacks without affecting legitimate clients that may make many queries from the same IP (e.g., a NAT gateway). What is the best approach?

Disable RRL and rely on firewall rules.

Set a high rate limit and a large slip value.

Set a low rate limit and a small slip value.

Enable recursion and set allow-recursion to any.

A security team requires that the BIND server run in a chroot jail. The current configuration uses relative paths for zone files, and the server is started via systemd. After moving the zone files into the jail, the server fails to start. What is the most likely cause?

The zone files are not owned by the named user.

The systemd service file does not specify the chroot directory.

The chroot directory does not have the correct permissions.

The named.conf file is not inside the chroot jail.

LPI LPIC-2:Linux Engineer (201-450)

Domain 8Objective 3

207.3 Securing a DNS Server (weight: 2) LPIC-2 Practice Questions (Page 1)

Part of the Topic 207: Domain Name Server domain, which makes up ~8% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 90-minute exam (~35–60 total, ~3–5 in this domain), expect 1–2 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

10concepts

10 Concepts in This Objective

DNS server security overview
Running BIND in a chroot environment
BIND configuration file permissions and ownership
Restricting zone transfers
Using TSIG for authentication
Restricting recursive queries
DNSSEC basics
Disabling recursion on authoritative servers
Logging and monitoring DNS server activity
Response rate limiting (RRL)

Questions 1–5

1foundation · easy
Which BIND configuration block is used to define logging categories and destinations?
Select an answer first
2expert · hard
A company runs a DNS server that is authoritative for its domain and also provides recursive resolution for employees. The server is currently configured with allow-recursion set to the internal network. A security audit recommends disabling recursion to reduce the attack surface. However, the company still needs internal recursive resolution. What is the best solution?
Select an answer first
3expert · hard
A DNS administrator is configuring response rate limiting (RRL) on an authoritative-only server. They want to mitigate amplification attacks without affecting legitimate clients that may make many queries from the same IP (e.g., a NAT gateway). What is the best approach?
Select an answer first
4foundation · easy
Which BIND option limits which clients can use the server for recursive queries?
Select an answer first
5expert · hard
A security team requires that the BIND server run in a chroot jail. The current configuration uses relative paths for zone files, and the server is started via systemd. After moving the zone files into the jail, the server fails to start. What is the most likely cause?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to LPIC-2

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “LPIC-2” is a trademark of its owner, used for identification only.

207.3 Securing a DNS Server (weight: 2) LPIC-2 Practice Questions (Page 1)

Questions 1–5

Which BIND configuration block is used to define logging categories and destinations?

A DNS administrator is configuring response rate limiting (RRL) on an authoritative-only server. They want to mitigate amplification attacks without affecting legitimate clients that may make many queries from the same IP (e.g., a NAT gateway). What is the best approach?

Which BIND option limits which clients can use the server for recursive queries?

A security team requires that the BIND server run in a chroot jail. The current configuration uses relative paths for zone files, and the server is started via systemd. After moving the zone files into the jail, the server fails to start. What is the most likely cause?

Keep studying — Topic 207: Domain Name Server