An organization wants to use DANE to authenticate the TLS certificate of its mail server (mail.example.com) without relying on public CAs. The domain example.com is DNSSEC-signed. Which record should be published to associate the mail server's certificate with the domain?

A CNAME record pointing mail.example.com to the certificate's public key.

A DNSKEY record for mail.example.com containing the certificate's public key.

A TLSA record in the _tcp.mail.example.com subdomain containing the certificate's hash and usage, selector, and matching type.

An MX record for example.com that includes the certificate's fingerprint.

In DNSSEC, what is the primary difference between a Key Signing Key (KSK) and a Zone Signing Key (ZSK)?

The KSK signs the DNSKEY records, while the ZSK signs all other records in the zone

The KSK is stored offline, while the ZSK is always stored online

The KSK is used for encryption, while the ZSK is used for signing

Two BIND servers are configured to use TSIG for zone transfers. The secondary server fails to transfer the zone, and the logs show 'bad key' errors. What is the most likely cause?

The zone is not signed with DNSSEC.

The TSIG key names or secrets do not match between the two servers.

The secondary server's IP address is not in the primary's allow-transfer ACL.

The primary server's clock is not synchronized with the secondary's clock.

An organization wants to use DANE to secure connections to its web server. The domain is DNSSEC-signed. Which condition must be met for DANE to work?

The web server must use a certificate from a public CA.

The TLSA record must be published at the root of the domain.

The domain must use NSEC3 instead of NSEC.

The client's resolver must perform DNSSEC validation and the TLSA record must be published in the signed zone.

LPIC-3 Security

Domain 1Objective 4

325.4 DNS and Cryptography (weight: 5) LPIC-3-SECURITY Practice Questions (Page 3)

Part of the Topic 325: Cryptography domain, which makes up ~28% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 90-minute exam (~35–60 total, ~10–17 in this domain), expect 3–4 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

9concepts

Questions 11–15

11application · medium
An organization wants to use DANE to authenticate the TLS certificate of its mail server (mail.example.com) without relying on public CAs. The domain example.com is DNSSEC-signed. Which record should be published to associate the mail server's certificate with the domain?
Select an answer first
12foundation · easy
In DNSSEC, what is the primary difference between a Key Signing Key (KSK) and a Zone Signing Key (ZSK)?
Select an answer first
13application · medium
Two BIND servers are configured to use TSIG for zone transfers. The secondary server fails to transfer the zone, and the logs show 'bad key' errors. What is the most likely cause?
Select an answer first
14application · medium
An organization wants to use DANE to secure connections to its web server. The domain is DNSSEC-signed. Which condition must be met for DANE to work?
Select an answer first
15foundation · easy
Which tool would you use to check the syntax and DNSSEC records of a zone file before loading it into BIND?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to LPIC-3-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “LPIC-3-SECURITY” is a trademark of its owner, used for identification only.