207.3 Securing a DNS Server (weight: 2) LPIC-2 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company is implementing DNSSEC for its public domain. The DNS administrator has generated the zone signing keys and signed the zone. However, external resolvers are reporting validation failures. The administrator has verified that the zone is correctly signed and the DNSKEY records are published. What is the most likely missing step?

   • AEnabling DNSSEC validation on the authoritative server.
   • BPublishing the DS record with the parent zone.
   • CSetting the zone's TTL to a lower value.
   • DConfiguring allow-recursion to any.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of running BIND in a chroot environment?

   • ATo improve query performance by isolating the process
   • BTo enable DNSSEC validation
   • CTo restrict the filesystem access of the BIND process
   • DTo allow BIND to listen on privileged ports without root
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which DNS record type is used to publish a zone's signing key in DNSSEC?

   • ASOA
   • BDNSKEY
   • CA
   • DMX
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which BIND option enables Response Rate Limiting?

   • Arecursion
   • Brate-limit
   • Cmax-cache-size
   • Dallow-query
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which command is used to generate a TSIG key for BIND?

   • Aopenssl genrsa
   • Bdnssec-keygen
   • Cnamed-checkconf
   • Drndc-confgen
   Reveal Solution Discussion Select an answer first