What is the purpose of Response Rate Limiting (RRL) in BIND?

To block all queries from unknown clients

To limit the number of queries a client can send per second

To reduce the impact of DNS amplification attacks

What is the main risk of setting world-readable permissions on BIND configuration files?

The files would be deleted automatically

The named process could not read the files

Unauthorized users could read sensitive information such as TSIG keys

Unauthorized users could modify the configuration

A DNS administrator suspects that a malicious client is attempting to enumerate the zone by querying for random subdomains. They want to enable logging that will capture these queries without overwhelming the system with logs. What should they configure?

Enable a security log category with a severity level of error.

Enable a general log category with a severity level of debug.

Enable a resolver log category with a severity level of warning.

Enable a query log category with a severity level of info and direct it to a dedicated log file.

A DNS administrator is setting up logging to monitor for suspicious activity. They want to capture all queries and also log security events. They are concerned about disk space usage. What is the best approach?

Use separate log files for queries and security events, and configure log rotation.

Log only security events and ignore queries.

Log everything to a single file with debug severity.

Log queries to syslog and security events to a file.

LPI LPIC-2:Linux Engineer (201-450)

Domain 8Objective 3

207.3 Securing a DNS Server (weight: 2) LPIC-2 Practice Questions (Page 2)

Part of the Topic 207: Domain Name Server domain, which makes up ~8% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 90-minute exam (~35–60 total, ~3–5 in this domain), expect 1–2 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

10concepts

10 Concepts in This Objective

DNS server security overview
Running BIND in a chroot environment
BIND configuration file permissions and ownership
Restricting zone transfers
Using TSIG for authentication
Restricting recursive queries
DNSSEC basics
Disabling recursion on authoritative servers
Logging and monitoring DNS server activity
Response rate limiting (RRL)

Questions 6–10

6foundation · easy
What is the purpose of Response Rate Limiting (RRL) in BIND?
Select an answer first
7foundation · easy
What is the main risk of setting world-readable permissions on BIND configuration files?
Select an answer first
8application · medium
A DNS administrator suspects that a malicious client is attempting to enumerate the zone by querying for random subdomains. They want to enable logging that will capture these queries without overwhelming the system with logs. What should they configure?
Select an answer first
9expert · hard
A DNS administrator is setting up logging to monitor for suspicious activity. They want to capture all queries and also log security events. They are concerned about disk space usage. What is the best approach?
Select an answer first
10foundation · easy
Which BIND statement restricts which servers are allowed to request a zone transfer?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to LPIC-2

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “LPIC-2” is a trademark of its owner, used for identification only.