A validating resolver returns SERVFAIL for a domain that is DNSSEC-signed. The administrator runs 'dig +dnssec example.com A' and sees an RRSIG record, but the AD flag is not set. What is the most likely cause?

The zone uses NSEC3, and the resolver does not support NSEC3.

The zone's signatures have expired, but the RRSIG is still displayed.

The resolver is not configured to validate DNSSEC.

The resolver cannot validate the chain of trust because the DS record at the parent is missing or incorrect.

What is the purpose of a TLSA record?

To redirect HTTPS traffic to another port

To specify which certificate authorities are allowed to issue certificates for a domain

To associate a certificate or public key with a domain name for DANE

To store the private key of a TLS certificate

An organization uses DANE to secure its SMTP server. They have published a TLSA record with usage 3 (DANE-EE) and a SHA-256 hash of the certificate. During a certificate renewal, the certificate is replaced with a new one. What must the administrator do to maintain DANE validation?

Do nothing; the TLSA record automatically updates when the certificate is renewed.

Update the TLSA record with the new certificate's hash before or at the same time as the certificate is deployed.

Change the TLSA record's usage to 0 (PKIX-TA) to allow any certificate from the same CA.

Remove the TLSA record temporarily and re-add it after the certificate is deployed.

LPIC-3 Security

Domain 1Objective 4

325.4 DNS and Cryptography (weight: 5) LPIC-3-SECURITY Practice Questions (Page 2)

Part of the Topic 325: Cryptography domain, which makes up ~28% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 90-minute exam (~35–60 total, ~10–17 in this domain), expect 3–4 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

9concepts

Questions 6–10

6application · medium
A validating resolver returns SERVFAIL for a domain that is DNSSEC-signed. The administrator runs 'dig +dnssec example.com A' and sees an RRSIG record, but the AD flag is not set. What is the most likely cause?
Select an answer first
7foundation · easy
Which DNS record type is used by DANE to associate a certificate with a domain?
Select an answer first
8foundation · easy
Which of the following record types is published in a DNSSEC-signed zone to provide authenticated denial of existence?
Select an answer first
9foundation · easy
What is the purpose of a TLSA record?
Select an answer first
10expert · hard
An organization uses DANE to secure its SMTP server. They have published a TLSA record with usage 3 (DANE-EE) and a SHA-256 hash of the certificate. During a certificate renewal, the certificate is replaced with a new one. What must the administrator do to maintain DANE validation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to LPIC-3-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “LPIC-3-SECURITY” is a trademark of its owner, used for identification only.

325.4 DNS and Cryptography (weight: 5) LPIC-3-SECURITY Practice Questions (Page 2)

Questions 6–10

A validating resolver returns SERVFAIL for a domain that is DNSSEC-signed. The administrator runs 'dig +dnssec example.com A' and sees an RRSIG record, but the AD flag is not set. What is the most likely cause?

Which DNS record type is used by DANE to associate a certificate with a domain?

Which of the following record types is published in a DNSSEC-signed zone to provide authenticated denial of existence?

What is the purpose of a TLSA record?

An organization uses DANE to secure its SMTP server. They have published a TLSA record with usage 3 (DANE-EE) and a SHA-256 hash of the certificate. During a certificate renewal, the certificate is replaced with a new one. What must the administrator do to maintain DANE validation?

Keep studying — Topic 325: Cryptography