What is the main security benefit of restricting recursive queries to authorized clients?

It prevents zone transfers to unauthorized servers

It speeds up DNS resolution for all clients

It prevents the server from being used in DNS amplification attacks

A BIND server is configured to run in a chroot jail. The administrator has placed the zone files in the jail and set ownership to named:named. However, the server is still unable to read the zone files, and the logs show 'permission denied'. What is the most likely cause?

The parent directories of the zone files do not have execute permission for the named user.

The zone files have permissions 644.

The zone files are owned by root and have permissions 644.

The chroot jail is not properly configured.

A DNS administrator needs to allow a partner organization's DNS server to perform zone transfers from their primary server. The partner's server IP address is not static. What is the most secure way to authenticate the zone transfer?

Use allow-transfer to any and rely on the partner's firewall.

Use allow-transfer with the partner's current IP address and update it when it changes.

Use allow-transfer with the partner's domain name.

Generate a TSIG key and configure it on both servers.

Which general principle is most effective in limiting the impact of a compromised DNS server process?

Using a strong root password for the server

Placing the server behind a firewall

Running the server with the least privileges necessary

Why is it important to restrict zone transfers to authorized slave servers?

To reduce the load on the primary server

To ensure the zone file is not modified

To prevent unauthorized users from reading the entire zone data

LPI LPIC-2:Linux Engineer (201-450)

Domain 8Objective 3

207.3 Securing a DNS Server (weight: 2) LPIC-2 Practice Questions (Page 5)

Part of the Topic 207: Domain Name Server domain, which makes up ~8% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 90-minute exam (~35–60 total, ~3–5 in this domain), expect 1–2 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

10concepts

10 Concepts in This Objective

DNS server security overview
Running BIND in a chroot environment
BIND configuration file permissions and ownership
Restricting zone transfers
Using TSIG for authentication
Restricting recursive queries
DNSSEC basics
Disabling recursion on authoritative servers
Logging and monitoring DNS server activity
Response rate limiting (RRL)

Questions 21–25

21foundation · easy
What is the main security benefit of restricting recursive queries to authorized clients?
Select an answer first
22expert · hard
A BIND server is configured to run in a chroot jail. The administrator has placed the zone files in the jail and set ownership to named:named. However, the server is still unable to read the zone files, and the logs show 'permission denied'. What is the most likely cause?
Select an answer first
23application · medium
A DNS administrator needs to allow a partner organization's DNS server to perform zone transfers from their primary server. The partner's server IP address is not static. What is the most secure way to authenticate the zone transfer?
Select an answer first
24foundation · easy
Which general principle is most effective in limiting the impact of a compromised DNS server process?
Select an answer first
25foundation · easy
Why is it important to restrict zone transfers to authorized slave servers?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to LPIC-2

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “LPIC-2” is a trademark of its owner, used for identification only.