A BIND resolver is configured to validate DNSSEC. Users report that they can resolve internal domains but get SERVFAIL for external domains. The administrator checks the resolver's logs and sees 'no valid RRSIG' errors for the root zone. What is the most likely cause?

The resolver's cache is corrupted.

The resolver's allow-query ACL is blocking external queries.

The root trust anchor is missing or outdated.

A company's internal BIND resolver is configured to validate DNSSEC. Users report that they can resolve names in the internal domain corp.example, but they receive SERVFAIL errors for external domains. The resolver's logs show 'validation failure' for several external domains. The company's firewall was recently reconfigured. Which action is most likely to resolve the issue?

Check that the resolver can reach the root servers and that the root trust anchor is correctly configured.

Update the internal zone's serial number and re-sign it.

Add the external domains to the resolver's allow-query ACL.

Disable DNSSEC validation on the resolver to allow all queries to succeed.

What is the primary purpose of TSIG in BIND?

To encrypt DNS queries between clients and servers

To authenticate and verify the integrity of messages between BIND servers

To compress DNS messages to reduce bandwidth

To sign DNS zone data for DNSSEC

An administrator is configuring a new DNSSEC-signed zone on BIND. They have generated a KSK and a ZSK. Which files must be present in the zone file to publish the keys and signatures?

The DS record for the KSK and the NSEC records for the zone.

The RRSIG records for the DNSKEY RRset and the NSEC3 records.

The DNSKEY records for both keys and the RRSIG records for the zone data.

The private key files for both keys and the SOA record.

LPIC-3 Security

Domain 1Objective 4

325.4 DNS and Cryptography (weight: 5) LPIC-3-SECURITY Practice Questions (Page 4)

Part of the Topic 325: Cryptography domain, which makes up ~28% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 90-minute exam (~35–60 total, ~10–17 in this domain), expect 3–4 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

9concepts

Questions 16–20

16expert · hard
A BIND resolver is configured to validate DNSSEC. Users report that they can resolve internal domains but get SERVFAIL for external domains. The administrator checks the resolver's logs and sees 'no valid RRSIG' errors for the root zone. What is the most likely cause?
Select an answer first
17application · medium
A company's internal BIND resolver is configured to validate DNSSEC. Users report that they can resolve names in the internal domain corp.example, but they receive SERVFAIL errors for external domains. The resolver's logs show 'validation failure' for several external domains. The company's firewall was recently reconfigured. Which action is most likely to resolve the issue?
Select an answer first
18application · medium
A BIND resolver is configured to validate DNSSEC. The administrator wants to test whether a specific domain's DNSSEC chain is valid. Which command should they use to see the validation status and the chain of trust?
Select an answer first
19foundation · easy
What is the primary purpose of TSIG in BIND?
Select an answer first
20application · medium
An administrator is configuring a new DNSSEC-signed zone on BIND. They have generated a KSK and a ZSK. Which files must be present in the zone file to publish the keys and signatures?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to LPIC-3-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “LPIC-3-SECURITY” is a trademark of its owner, used for identification only.

325.4 DNS and Cryptography (weight: 5) LPIC-3-SECURITY Practice Questions (Page 4)

Questions 16–20

A BIND resolver is configured to validate DNSSEC. Users report that they can resolve internal domains but get SERVFAIL for external domains. The administrator checks the resolver's logs and sees 'no valid RRSIG' errors for the root zone. What is the most likely cause?

A BIND resolver is configured to validate DNSSEC. The administrator wants to test whether a specific domain's DNSSEC chain is valid. Which command should they use to see the validation status and the chain of trust?

What is the primary purpose of TSIG in BIND?

An administrator is configuring a new DNSSEC-signed zone on BIND. They have generated a KSK and a ZSK. Which files must be present in the zone file to publish the keys and signatures?

Keep studying — Topic 325: Cryptography