Module 07: Configure DNS

Which of the following statements are true regarding the DNSKEY key and the RRSIG key? Select two.

• RRSIG records are returned with the requested resource records for validation purposes

• DNSKEY is a public and private key combination in a certificate to sign the zone

• RRSIG records hold the name of a delegated zone used to verify delegated child zones

• They are used to fulfill the authenticated denial-of-existence security feature of DNSSEC

• DNSKEY is a public key; DNS resolvers use it to verify digital signatures in RRSIG records

You create a subdomain and delegate it to a zone on a new DNS server. You assign 172.16.1.100 as the address of the new DNS server. After a month of operation a decision is made to change the address to 192.168.1.100. What are the consequences of this change and/or what additional action should be taken, if any?

• You need to manually update the NS record on the server hosting the parent domain

• You need to update the glue A record on the server hosting the parent domain

• The change will be propagated to the DNS server hosting the parent domain

• After changing the IP address restart the system to trigger an automatic update

What benefits are derived with the DNS socket pool used by a DNS server for DNS queries? Select two.

• Makes it more difficult for an attacker to guess the destination port number

• Allows a DNS client to use up to 10000 random source port numbers

• Makes it more difficult for an attacker to guess the source port number

• Specifies the number of values available for use as the transaction ID

• Can be used to help protect and guard against DNS cache poisoning

Some employees are saying the network is slow. You notice DNS responses seem to be taking a lot longer than usual. You start to monitor traffic. You notice signs that a DNS amplification attack may be in progress. Which one of the following best describes what you can configure or enable to help mitigate the problem?

• RRL

• DANE

• TLSA

• DNSSEC

In the process of configuring access to a service on a server, you invoke DNS Manager to add an SRV record. What Transport-layer protocols are available for selection?

• TCP

• MSDCS

• Telnet

• TLSA

• UDP

You need to configure DNSSEC to include protection against attackers issuing queries with the intention of getting all the names in a zone. Which option will you select to satisfy this requirement?

• NSEC3

• NSEC3PARAM

• NSEC

• Trust Anchor

A .corp TLD server refers queries for resources in the images.myorg.corp to a DNS server that is authoritative for the myorg.corp domain. What type of resource record facilitates this capability? Choose one of the options below.

• PTR

• SRV

• NS

• SOA

In the process of creating a new forest Fuyuko starts installing Active Directory. During the process an indication is issued because the system was not able to find a DNS server. What should Fuyuko do?

• Ignore the warning and continue installation

• Install and configure a DNS server

• Restart the installation process

• Disconnect from the network

Ember is adding a forest to an existing environment. What type of DNS entity should Ember configure so devices can resolve hostnames between forests?

• Conditional forwarder

• Round Robin forwarder

• Recursive DNS forwarder

• Traditional forwarder

Your company has a large file and media server that is constantly in use by a large pool of users. You set up two additional servers to mirror the data to reduce access times. In addition, you configure the DNS server to respond to queries by sending in the response all three IP addresses on a rotating basis. Which one of the following TTL values would you be most inclined to configure?

• 40 minutes

• 60 minutes

• 5 minutes

• 20 minutes