312-50V9 · Question #543
Let's imagine three companies (A, B and C), all competing in a challenging global environment. Company A and B are working together in developing a product that will generate a major competitive…
The correct answer is C. Install DNS Anti-spoofing. DNS anti-spoofing mechanisms such as DNSSEC protect against cache poisoning by cryptographically validating DNS responses. Disabling zone transfers limits enumeration but does not address spoofing of individual responses.
Question
Let's imagine three companies (A, B and C), all competing in a challenging global environment. Company A and B are working together in developing a product that will generate a major competitive advantage for them. Company A has a secure DNS server while company B has a DNS server vulnerable to spoofing. With a spoofing attack on the DNS server of company B, company C gains access to outgoing e-mails from company B. How do you prevent DNS spoofing? (Select the Best Answer.)
Options
- AInstall DNS logger and track vulnerable packets
- BDisable DNS timeouts
- CInstall DNS Anti-spoofing
- DDisable DNS Zone Transfer
How the community answered
(33 responses)- A6% (2)
- B3% (1)
- C76% (25)
- D15% (5)
Why each option
DNS anti-spoofing mechanisms such as DNSSEC protect against cache poisoning by cryptographically validating DNS responses. Disabling zone transfers limits enumeration but does not address spoofing of individual responses.
Installing a DNS logger can detect anomalous traffic after the fact but provides no preventive protection against spoofed DNS responses being accepted by a resolver.
Disabling DNS timeouts has no relationship to spoofing prevention and would actually impair normal DNS resolution functionality.
DNS anti-spoofing, implemented through DNSSEC (DNS Security Extensions), uses digital signatures to authenticate DNS responses and ensure data integrity. When a resolver receives a DNS response, DNSSEC allows it to verify the response was signed by the authoritative server and has not been tampered with. This directly prevents an attacker from injecting forged DNS records into a cache, which is the mechanism used in the spoofing attack described.
Disabling DNS zone transfers prevents unauthorized bulk enumeration of DNS records but does not stop an attacker from forging individual spoofed DNS responses.
Concept tested: DNSSEC anti-spoofing protection mechanisms
Source: https://learn.microsoft.com/en-us/windows-server/networking/dns/dnssec-overview
Topics
Community Discussion
No community discussion yet for this question.