325.4 DNS and Cryptography (weight: 5) LPIC-3-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company operates a DNSSEC-signed zone with a KSK and ZSK. They need to roll the KSK because it may have been compromised. They want to minimize the risk of validation failures during the rollover. Which procedure should they follow?

   • ARemove the old KSK first, then add the new KSK and update the DS record.
   • BGenerate a new ZSK and use it to sign the new KSK, then update the DS record.
   • CPublish the new KSK in the DNSKEY RRset, wait for the DNSKEY TTL and the parent's DS record TTL to expire, then update the DS record at the parent, and finally remove the old KSK.
   • DImmediately replace the old KSK with the new KSK in the DNSKEY RRset and update the DS record at the parent at the same time.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which BIND configuration statement enables DNSSEC signing for a zone?

   • Aauto-dnssec maintain;
   • Bdnssec-enable yes;
   • Cdnssec-secure-to-insecure yes;
   • Ddnssec-validation auto;
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is required for a TLSA record to be usable for DANE validation?

   • AThe domain must use an HTTPS-only policy
   • BThe certificate must be issued by a public CA
   • CThe zone must be DNSSEC-signed
   • DThe TLSA record must be signed by a private key
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which command-line tool is specifically designed to perform DNSSEC validation and can be used to troubleshoot validation issues?

   • Anamed-checkzone
   • Bdig
   • Cdelv
   • Dopenssl
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is a key tag in DNSSEC?

   • AA timestamp indicating when the key was created
   • BA flag indicating whether the key is a KSK or ZSK
   • CA secret passphrase used to protect the private key
   • DA unique identifier for a DNSKEY record used to reference it in DS records
   Reveal Solution Discussion Select an answer first