CAS-002 · Question #141
An IT administrator wants to restrict DNS zone transfers between two geographically dispersed, external company DNS name servers, and has decided to use TSIG. Which of the following are critical…
The correct answer is B. Secure exchange of the key values between the two DNS name servers. C. A secure NTP source used by both DNS name servers to avoid message rejection. TSIG (Transaction Signature) secures DNS zone transfers using shared secret keys and timestamps, making secure key exchange and synchronized time both critical requirements. Without these two elements, TSIG cannot reliably authenticate or verify DNS messages.
Question
An IT administrator wants to restrict DNS zone transfers between two geographically dispersed, external company DNS name servers, and has decided to use TSIG. Which of the following are critical when using TSIG? (Select TWO).
Options
- APeriodic key changes once the initial keys are established between the DNS name servers.
- BSecure exchange of the key values between the two DNS name servers.
- CA secure NTP source used by both DNS name servers to avoid message rejection.
- DDNS configuration files on both DNS name servers must be identically encrypted.
- EAES encryption with a SHA1 hash must be used to encrypt the configuration files on both
How the community answered
(22 responses)- A5% (1)
- B82% (18)
- D5% (1)
- E9% (2)
Why each option
TSIG (Transaction Signature) secures DNS zone transfers using shared secret keys and timestamps, making secure key exchange and synchronized time both critical requirements. Without these two elements, TSIG cannot reliably authenticate or verify DNS messages.
Periodic key rotation is a good security hygiene practice but is not a critical requirement for TSIG to function correctly between two servers.
TSIG relies on a shared secret HMAC key; if the key is intercepted during initial exchange, an attacker can forge authenticated DNS messages and perform unauthorized zone transfers.
TSIG timestamps each message to prevent replay attacks, and both DNS servers must agree on the current time within a small skew window - typically 300 seconds - so a common, trusted NTP source is essential to avoid legitimate messages being rejected as replayed.
TSIG does not require DNS configuration files to be identically encrypted; it only requires that both sides share the same HMAC key value.
TSIG does not mandate AES encryption of configuration files; it uses HMAC algorithms such as HMAC-MD5 or HMAC-SHA to sign DNS messages, not to encrypt files on disk.
Concept tested: TSIG authentication requirements for DNS zone transfers
Source: https://www.rfc-editor.org/rfc/rfc8945
Topics
Community Discussion
No community discussion yet for this question.