312-50V11 · Question #110
Let's imagine three companies (A, B and C), all competing in a challenging global environment. Company A and B are working together in developing a product that will generate a major competitive…
The correct answer is C. Install DNS Anti-spoofing. DNS spoofing is prevented by deploying DNS anti-spoofing mechanisms such as DNSSEC, which cryptographically validates DNS responses and prevents forged replies from being accepted.
Question
Let's imagine three companies (A, B and C), all competing in a challenging global environment. Company A and B are working together in developing a product that will generate a major competitive advantage for them. Company A has a secure DNS server while company B has a DNS server vulnerable to spoofing. With a spoofing attack on the DNS server of company B, company C gains access to outgoing e-mails from company B. How do you prevent DNS spoofing? (Select the Best Answer.)
Options
- AInstall DNS logger and track vulnerable packets
- BDisable DNS timeouts
- CInstall DNS Anti-spoofing
- DDisable DNS Zone Transfer
How the community answered
(39 responses)- A13% (5)
- B5% (2)
- C74% (29)
- D8% (3)
Why each option
DNS spoofing is prevented by deploying DNS anti-spoofing mechanisms such as DNSSEC, which cryptographically validates DNS responses and prevents forged replies from being accepted.
A DNS logger only records query activity for auditing purposes and does nothing to block or validate spoofed DNS responses in real time.
DNS timeouts control how long a resolver waits for a response and have no relationship to validating the authenticity of DNS replies.
Installing DNS anti-spoofing - specifically DNSSEC (DNS Security Extensions) - is the direct technical countermeasure against DNS spoofing. DNSSEC uses digital signatures to authenticate DNS responses, ensuring that a resolver receives legitimate, unaltered records rather than forged ones injected by an attacker.
Disabling DNS Zone Transfer restricts replication of zone data between servers to prevent unauthorized enumeration, but it does not address response forgery in spoofing attacks.
Concept tested: DNS spoofing prevention using DNSSEC
Source: https://learn.microsoft.com/en-us/windows-server/networking/dns/deploy/dnssec
Topics
Community Discussion
No community discussion yet for this question.