303-300 · Question #47
Which of the following DNS record types can the command dnssec-signzone add to a zone? (Choose THREE correct answers.)
The correct answer is B. NSEC C. NSEC3 E. RRSIG. dnssec-signzone signs a DNS zone using DNSSEC and produces three legitimate record types: RRSIG (E) - the cryptographic signature attached to every RRset in the zone, proving its authenticity; NSEC (B) - the "Next Secure" record that chains zone names alphabetically to prove…
Question
Which of the following DNS record types can the command dnssec-signzone add to a zone? (Choose THREE correct answers.)
Options
- AASIG
- BNSEC
- CNSEC3
- DNSSIG
- ERRSIG
How the community answered
(30 responses)- A10% (3)
- B87% (26)
- D3% (1)
Explanation
dnssec-signzone signs a DNS zone using DNSSEC and produces three legitimate record types: RRSIG (E) - the cryptographic signature attached to every RRset in the zone, proving its authenticity; NSEC (B) - the "Next Secure" record that chains zone names alphabetically to prove authenticated denial of existence; and NSEC3 (C) - a hashed variant of NSEC (enabled with the -3 flag) that prevents zone enumeration/walking by obscuring record names. ASIG (A) and NSSIG (D) are fabricated record types that do not exist in any DNS standard - they're classic exam distractors designed to test whether you know real acronyms.
Memory tip: Think of the three real types as "R-N-N" - RRSIG signs, NSEC denies, NSEC3 denies with hashing. Any other "-SIG" variant (ASIG, NSSIG) is a red flag invented for distraction.
Topics
Community Discussion
No community discussion yet for this question.