325.4 DNS and Cryptography (weight: 5) LPIC-3-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Why must DNSSEC-signed zones be re-signed periodically?

   • ATo prevent signature expiration, which would cause validation failures
   • BTo update the NS records to point to new name servers
   • CTo ensure the zone remains encrypted
   • DTo change the zone's serial number
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company runs two BIND name servers: a primary and a secondary. They want to ensure that zone transfers from the primary to the secondary are authenticated and that only the secondary can request transfers. Which configuration should be used on the primary server?

   • AUse DNSSEC to sign the zone and rely on the signatures to authenticate the transfer.
   • BGenerate a TSIG key, add it to both servers' configurations, and use the 'allow-transfer' option with the key name in the zone definition.
   • CSet the 'notify' option to 'explicit' and list the secondary's IP address.
   • DUse the 'allow-query' option to restrict queries to the secondary's IP address.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which BIND configuration option enables DNSSEC validation on a recursive resolver?

   • Adnssec-trust-anchors;
   • Bdnssec-lookaside auto;
   • Cdnssec-validation auto;
   • Ddnssec-enable yes;
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A DNSSEC-signed zone is served by BIND. Users report that some resolvers return SERVFAIL for the zone. The administrator runs 'dig example.com A' and receives a response with the AD flag, but 'dig +dnssec example.com A' shows no RRSIG records. What is the most likely cause?

   • AThe zone is not actually signed; the AD flag in the first response came from a validating resolver that had a cached valid response.
   • BThe zone uses NSEC3, and the RRSIG records are only visible with the +nsid flag.
   • CThe zone's signatures have expired, and the resolver is returning SERVFAIL because it cannot validate the expired signatures.
   • DThe resolver is not configured to validate DNSSEC, so it strips the RRSIG records from the response.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company runs an authoritative BIND server for example.com. They recently signed the zone with DNSSEC using a single key. Now they want to implement a proper key hierarchy with a Key Signing Key (KSK) and a Zone Signing Key (ZSK). They also want to minimize the risk of a compromised ZSK allowing an attacker to forge zone data. Which approach best meets these requirements?

   • AGenerate a KSK and use it to sign all records in the zone, including the DNSKEY RRset, and publish the DS record for the KSK at the parent.
   • BGenerate a ZSK and use it to sign the DNSKEY RRset, and generate a KSK to sign the zone data, then publish the DS record for the ZSK at the parent.
   • CGenerate a new KSK and ZSK, sign the zone with the ZSK, and use the KSK to sign the DNSKEY RRset. Publish the DS record for the KSK at the parent zone.
   • DUse a single key for both signing the zone and signing the DNSKEY RRset, but increase the key size to 4096 bits to improve security.
   Reveal Solution Discussion Select an answer first