An IT administrator wants to restrict DNS zone transfers between two geographically dispersed, external company DNS name servers, and has decided to use TSIG. Which of the following are critical…

Question

Options

• APeriodic key changes once the initial keys are established between the DNS name servers.
• BSecure exchange of the key values between the two DNS name servers.
• CA secure NTP source used by both DNS name servers to avoid message rejection.
• DDNS configuration files on both DNS name servers must be identically encrypted.
• EAES encryption with a SHA1 hash must be used to encrypt the configuration files on both DNS

• A
  3% (1)
• B
  85% (29)
• D
  9% (3)
• E
  3% (1)

Explanation

TSIG (Transaction SIGnature) authenticates DNS messages using a shared secret key and timestamps. Two things are critical: (B) Secure exchange of key values - TSIG relies entirely on a pre-shared symmetric secret; if that key is intercepted or compromised during initial exchange, all TSIG-authenticated messages can be forged. The security of the entire mechanism depends on key confidentiality. (C) Secure NTP time synchronization - TSIG includes a timestamp in every signed message and rejects messages outside a defined time window (typically 5 minutes) to prevent replay attacks. If the two servers' clocks are not synchronized, legitimate zone transfers will be rejected as if they were replays. Option A (periodic key rotation) is good hygiene but not strictly critical to TSIG functioning. Options D and E describe encryption requirements that are not part of the TSIG specification.

No community discussion yet for this question.