312-50V9 · Question #544
Which DNS resource record can indicate how long any "DNS poisoning" could last?
The correct answer is B. SOA. The SOA (Start of Authority) record contains the minimum TTL value that determines how long DNS records, including poisoned ones, are cached by resolvers. The TTL value in poisoned records directly controls the duration of a DNS cache poisoning attack.
Question
Which DNS resource record can indicate how long any "DNS poisoning" could last?
Options
- AMX
- BSOA
- CNS
- DTIMEOUT
How the community answered
(39 responses)- B92% (36)
- C5% (2)
- D3% (1)
Why each option
The SOA (Start of Authority) record contains the minimum TTL value that determines how long DNS records, including poisoned ones, are cached by resolvers. The TTL value in poisoned records directly controls the duration of a DNS cache poisoning attack.
MX records specify the mail exchange servers for a domain and their priority values, and contain no TTL or caching duration information relevant to poisoning persistence.
The SOA record includes a minimum TTL field that sets the default caching lifetime for all records in the zone. When an attacker successfully injects a poisoned DNS record into a resolver's cache, that record will persist for the duration of its TTL value - which is governed by the zone's SOA settings. A high TTL means poisoned records remain in caches longer, extending the window of the attack.
NS records identify the authoritative name servers for a zone but do not contain the TTL configuration that controls how long cached records, including poisoned ones, are retained.
TIMEOUT is not a valid DNS resource record type - it does not exist in the DNS standard record set.
Concept tested: SOA record TTL and DNS cache poisoning duration
Source: https://learn.microsoft.com/en-us/windows-server/networking/dns/manage/manage-resource-records
Topics
Community Discussion
No community discussion yet for this question.