A security audit recommends that a BIND server be run in a chroot environment to limit the impact of a potential compromise. The server currently runs as the named user and stores zone files in /var/named. After configuring the chroot jail, what additional step is required to ensure BIND can read the zone files?

Set the named user's home directory to the chroot directory.

Copy the zone files into the chroot jail and set ownership to named:named with appropriate permissions.

Change the ownership of /var/named to root:root and set permissions to 755.

Create a symlink from /var/named to the chroot directory.

A company's DNS administrator is concerned about DNS spoofing attacks on their public domain. They want to ensure that resolvers can verify the authenticity of DNS responses. What should they implement?

Sign the zone with DNSSEC and publish the DS record with the parent zone.

Restrict recursion to internal clients only.

Enable response rate limiting on the authoritative server.

Use TSIG to sign all DNS responses.

A company runs a public DNS server that only hosts authoritative zones for its domain. The server also provides recursive resolution for internal employees. After a security review, the company decides to make the server authoritative-only to reduce its attack surface. What configuration change is required?

Set allow-query to the internal network only.

Set recursion no in the options block.

Set allow-recursion to the internal network only.

A company is planning to deploy DNSSEC for its domain. The DNS administrator is concerned about the operational overhead of key management. They want to minimize the risk of key compromise while ensuring continuous validation. What is the best practice?

Disable DNSSEC validation on the authoritative server.

Use a Key Signing Key (KSK) and a Zone Signing Key (ZSK) with regular key rollovers.

Use a ZSK only and publish it in the DNSKEY record.

Use a single key for both signing and key signing.

What is the purpose of TSIG in BIND?

To authenticate messages between DNS servers

To compress DNS messages for faster transmission

To encrypt DNS queries and responses

To provide confidentiality for zone transfers

LPI LPIC-2:Linux Engineer (201-450)

Domain 8Objective 3

207.3 Securing a DNS Server (weight: 2) LPIC-2 Practice Questions (Page 3)

Part of the Topic 207: Domain Name Server domain, which makes up ~8% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 90-minute exam (~35–60 total, ~3–5 in this domain), expect 1–2 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

10concepts

10 Concepts in This Objective

DNS server security overview
Running BIND in a chroot environment
BIND configuration file permissions and ownership
Restricting zone transfers
Using TSIG for authentication
Restricting recursive queries
DNSSEC basics
Disabling recursion on authoritative servers
Logging and monitoring DNS server activity
Response rate limiting (RRL)

Questions 11–15

11application · medium
A security audit recommends that a BIND server be run in a chroot environment to limit the impact of a potential compromise. The server currently runs as the named user and stores zone files in /var/named. After configuring the chroot jail, what additional step is required to ensure BIND can read the zone files?
Select an answer first
12application · medium
A company's DNS administrator is concerned about DNS spoofing attacks on their public domain. They want to ensure that resolvers can verify the authenticity of DNS responses. What should they implement?
Select an answer first
13application · medium
A company runs a public DNS server that only hosts authoritative zones for its domain. The server also provides recursive resolution for internal employees. After a security review, the company decides to make the server authoritative-only to reduce its attack surface. What configuration change is required?
Select an answer first
14expert · hard
A company is planning to deploy DNSSEC for its domain. The DNS administrator is concerned about the operational overhead of key management. They want to minimize the risk of key compromise while ensuring continuous validation. What is the best practice?
Select an answer first
15foundation · easy
What is the purpose of TSIG in BIND?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to LPIC-2

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “LPIC-2” is a trademark of its owner, used for identification only.

207.3 Securing a DNS Server (weight: 2) LPIC-2 Practice Questions (Page 3)

Questions 11–15

A company's DNS administrator is concerned about DNS spoofing attacks on their public domain. They want to ensure that resolvers can verify the authenticity of DNS responses. What should they implement?

A company is planning to deploy DNSSEC for its domain. The DNS administrator is concerned about the operational overhead of key management. They want to minimize the risk of key compromise while ensuring continuous validation. What is the best practice?

What is the purpose of TSIG in BIND?

Keep studying — Topic 207: Domain Name Server