MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

Which primary goal does DNSSEC aim to achieve in DNS infrastructure?
a. Authentication of responses
b. Data compression
c. Performance optimization
d. Traffic encryption
Answer: a. Authentication of responsesinfoblox+1
DNSSEC defends DNS infrastructure primarily by:
a. Blocking all UDP traffic
b. Cryptographically signing DNS data
c. Using VPN tunnels
d. Isolating DNS servers
Answer: b. Cryptographically signing DNS datacatchpoint+1
What form of cryptography is essential for DNSSEC operation?
a. Symmetric encryption
b. Hash chains
c. Public key cryptography
d. OTPs
Answer: c. Public key cryptographycatchpoint+1
DNSSEC validates the authenticity of which DNS element?
a. DNS queries only
b. DNS responses only
c. Both DNS queries and responses
d. Only IP packets
Answer: b. DNS responses onlycloudflare+1
Which resource record contains a zone’s public key for DNSSEC?
a. A
b. TXT
c. DNSKEY
d. SPF
Answer: c. DNSKEYakamai+1
In DNSSEC, what is the purpose of a Delegation Signer (DS) record?
a. Encrypt queries
b. Chain trust from parent to child zones
c. Store DNS resolver IPs
d. Perform client authentication
Answer: b. Chain trust from parent to child zoneslinkedin+1
Which two cryptographic keys are central to DNSSEC?
a. Key Signing Key and Zone Signing Key
b. Session Key and Master Key
c. Private Key and Symmetric Key
d. Secret Key and Session Key
Answer: a. Key Signing Key and Zone Signing Keyakamai+1
What is the function of the RRSIG record in DNSSEC?
a. Holds additional zone metadata
b. Stores digital signatures for DNS records
c. Lists trusted server IPs
d. Performs recursive queries
Answer: b. Stores digital signatures for DNS recordsinfoblox+1
Which DNSSEC resource record proves the nonexistence of a DNS record?
a. DS
b. A
c. NSEC/NSEC3
d. PTR
Answer: c. NSEC/NSEC3codilime+1
In cloud platforms, DNSSEC often requires support from:
a. Load balancers only
b. Both recursive and authoritative DNS servers
c. Proxy servers only
d. End-user clients only
Answer: b. Both recursive and authoritative DNS serverscloudflare+1
Which type of attack does DNSSEC specifically prevent?
a. SYN flooding
b. DNS cache poisoning
c. Zero-day exploits
d. Buffer overflows
Answer: b. DNS cache poisoninglinkedin+1
What happens if a DNSSEC validation fails on a DNS resolver?
a. Resolver returns the record anyway
b. Resolver returns a “SERVFAIL” error
c. Record is cached with warnings
d. Query is sent to a random server
Answer: b. Resolver returns a “SERVFAIL” erroricann+1
Which of the following is NOT provided by DNSSEC?
a. Message authentication
b. Data integrity
c. Data confidentiality
d. Authenticated denial of existence
Answer: c. Data confidentialitydnsinstitute+1
What does DNSSEC require to create a full “chain of trust?”
a. Only signed root zone
b. All zones in the hierarchy are signed
c. Only authoritative DNSSEC records
d. No zone signing necessary
Answer: b. All zones in the hierarchy are signedakamai+1
Cloud DNS hosting providers enable DNSSEC by:
a. Automatically signing all zones
b. Offering it as an optional, configurable feature
c. Only supporting it for A records
d. Disabling signature support
Answer: b. Offering it as an optional, configurable featureicann+1
How does DNSSEC impact DNS response sizes?
a. Reduces response size
b. No effect on size
c. Increases response size due to additional signature data
d. Compresses all data
Answer: c. Increases response size due to additional signature datacatchpoint+1
What is “zone walking” in the context of NSEC records?
a. Crawling website content
b. Systematically listing all valid DNS records in a zone
c. Jumping between DNS servers
d. Checking IP reputations
Answer: b. Systematically listing all valid DNS records in a zonecatchpoint+1
Which record type was introduced to mitigate “zone walking?”
a. NSEC
b. ARP
c. NSEC3
d. A
Answer: c. NSEC3akamai+1
Which of the following is NOT a challenge associated with DNSSEC deployment in cloud?
a. Key management complexity
b. Larger DNS response traffic
c. Automatic encryption of all traffic
d. Slow adoption rates
Answer: c. Automatic encryption of all trafficinfoblox+1
DNSSEC-signed zones may increase vulnerability to which network risk?
a. DDoS amplification
b. Malware injection
c. Link layer sniffing
d. Brute force password attacks
Answer: a. DDoS amplificationcatchpoint
Which of the following steps is essential to enable DNSSEC in an ISC BIND resolver?
a. Add “dnssec-validation auto;” to named options
b. Enable BGP routing authentication
c. Implement SSL/TLS certificates
d. Upgrade to IPv6-only DNS
Answer: a. Add “dnssec-validation auto;” to named optionscatchpoint
What does a parent DNS zone validate for a child zone in DNSSEC?
a. Public keys and DS records
b. A records
c. SPF entries
d. DNS query logs
Answer: a. Public keys and DS recordslinkedin+1
As of 2025, why do many organizations hesitate to deploy DNSSEC widely in cloud environments?
a. It is illegal in most countries
b. Complexity and performance concerns
c. Insufficient DNS record types supported
d. Only works with public DNS servers
Answer: b. Complexity and performance concernscloudflare+1
The “chain of trust” in DNSSEC begins with:
a. Leaf nodes
b. DNS root zone
c. Cloud provider zones
d. Resolver logs
Answer: b. DNS root zoneinfoblox+1
For DNSSEC to prevent spoofing, DNS resolvers must be:
a. Signature-aware and validation-enabled
b. Hosted on-premises only
c. IPv6-compatible
d. HTTP proxy-enabled
Answer: a. Signature-aware and validation-enabledinfoblox+1
Which layer of DNS typically does NOT directly implement DNSSEC validation?
a. Root servers
b. TLD servers
c. Authoritative name servers
d. End-user devices
Answer: d. End-user devicesdnsinstitute+1
DNSSEC provides assurance that:
a. DNS data comes from a trusted source and hasn’t been altered
b. DNS traffic is always private
c. Only IPv6 queries are accepted
d. Cloud resource billing is secure
Answer: a. DNS data comes from a trusted source and hasn’t been alteredcloudflare+1
What is the Zone Signing Key (ZSK) used for in DNSSEC?
a. Signing zone-specific records
b. Encrypting web traffic
c. Validating SPF records
d. Resetting DNS caches
Answer: a. Signing zone-specific recordslinkedin+1
What is the Key Signing Key (KSK) used for in DNSSEC?
a. Signing the ZSK records
b. Encrypting whole communications
c. Attesting to user identity
d. Creating new domains
Answer: a. Signing the ZSK recordslinkedin+1
If DNSSEC signatures fail to validate at any point, what is the result?
a. DNSSEC is bypassed automatically
b. The DNS query is terminated with an error
c. Only MX records are retrieved
d. Query is forwarded to other zones
Answer: b. The DNS query is terminated with an erroricann+1
Which type of DNS server stores DNSSEC-enabled, signed records?
a. Authoritative name server
b. Caching proxy
c. SMTP gateway
d. DHCP relay
Answer: a. Authoritative name servericann+1
Which DNSSEC mechanism handles authenticated denial of existence?
a. A record
b. RRSIG record
c. NSEC/NSEC3 record
d. NS record
Answer: c. NSEC/NSEC3 recordcodilime+1
DNSSEC does NOT authenticate which of the following?
a. Records that are unsigned
b. Signed RRSIG records
c. Secure DS records
d. Secure NSEC3 records
Answer: a. Records that are unsignedakamai+1
DNSSEC failure in a public cloud infrastructure may result from:
a. Unsigned zones in the chain of trust
b. Multi-cloud DNS caching
c. Record name collisions
d. Mandatory IPv6
Answer: a. Unsigned zones in the chain of trustcloudflare+1
Why is it important for the DS record to be published in the parent zone?
a. To enable DNS load balancing
b. To establish the chain of trust for child zone verification
c. To encrypt DNS queries
d. To prevent anti-spam blocklists
Answer: b. To establish the chain of trust for child zone verificationlinkedin+1
What is a primary benefit of DNSSEC in cloud environments?
a. Guarantees routing efficiency
b. Authenticates source and integrity of DNS data
c. Makes DNS queries confidential
d. Automates cloud resource provisioning
Answer: b. Authenticates source and integrity of DNS datainfoblox+1
When implementing DNSSEC, who holds the private signing key?
a. The authoritative DNS server administrator
b. Any DNS client
c. Every recursive resolver
d. Public registries only
Answer: a. The authoritative DNS server administratorcatchpoint+1
Which concept describes how DNSSEC chains trust from the root to individual domains?
a. Hierarchical digital signatures
b. Round-robin load balancing
c. Firewall chaining
d. Multi-factor authentication
Answer: a. Hierarchical digital signaturescloudflare+1
In DNSSEC, why is regular key rollover needed?
a. To distribute keys to more servers
b. To retire old keys for security reasons
c. For compliance with IPv6
d. To support load balancing
Answer: b. To retire old keys for security reasonsakamai+1
How can cloud organizations test if their DNSSEC deployment is effective?
a. Checking DNSSEC validation logs and failed validations
b. Performing traceroute for DNS queries
c. Disabling NSEC3 records
d. Blocking UDP on all DNS servers
Answer: a. Checking DNSSEC validation logs and failed validationsicann+1
A critical DNSSEC adoption barrier for cloud providers is:
a. Lack of standardization
b. Additional operational complexity and overhead
c. Prevalence of A records
d. Mandatory DNS over HTTPS
Answer: b. Additional operational complexity and overheadcloudflare+1
Which is TRUE about DNSSEC’s effect on internet privacy?
a. Enhances privacy by encrypting lookups
b. Does not encrypt data; authentication only
c. Anonymizes all IP addresses
d. Deactivates logging
Answer: b. Does not encrypt data; authentication onlyinfoblox+1
DNSSEC deployment is considered “backward compatible” because:
a. Unsigned domains still work with DNSSEC-aware servers
b. IPv4 is required
c. Clouds can block all unsigned records
d. It mandates DNS-over-HTTPS
Answer: a. Unsigned domains still work with DNSSEC-aware serverscloudflare+1
When a zone is not DNSSEC-signed, how does DNSSEC-aware software respond?
a. Rejects the zone entirely
b. Falls back to regular DNS processing
c. Encrypts all outgoing packets
d. Switches to TCP only
Answer: b. Falls back to regular DNS processingicann+1
Which two record types work together to create the DNSSEC-signed authority for a zone?
a. DNSKEY and RRSIG
b. PTR and TXT
c. NS and SOA
d. MX and CNAME
Answer: a. DNSKEY and RRSIGcatchpoint+1
What is the core function of the DS record in DNSSEC hierarchy?
a. Store zone transfer statistics
b. Act as a trust anchor linking parent and child zones
c. Cache A records
d. Block unsigned queries
Answer: b. Act as a trust anchor linking parent and child zoneslinkedin+1
Which aspect of DNS traffic does DNSSEC NOT address?
a. Integrity
b. Source verification
c. Confidentiality
d. Authentication
Answer: c. Confidentialityinfoblox+1
Which protocol does DNS typically use for queries, increasing susceptibility to spoofing?
a. SMTP
b. HTTP
c. UDP
d. FTP
Answer: c. UDPcatchpoint+1
What problem in DNS security does DNSSEC solve that traditional DNS cannot?
a. End-to-end traffic encryption
b. Tampering detection via signatures
c. Web proxy data transfer
d. Biometric client logins
Answer: b. Tampering detection via signaturescloudflare+1
For a DNSSEC-enabled cloud, what must be done if the domain moves between providers?
a. Update DS records at the parent zone to new keys
b. Only migrate A records
c. Delete all DNS records
d. Disable DNSSEC temporarily
Answer: a. Update DS records at the parent zone to new keysakamai+1

Blog

Systemethic Technologies

Leave a Reply Cancel reply

Useful links

Other Terms & Policies

Contact Info