A company has a primary DNS server at address 192.168.10.53 and a secondary server at 192.168.20.53. An administrator wants to secure a company by only allowing secure zone transfers to the…

This option contains an incorrect configuration structure or algorithm specification that does not properly bind the TSIG key to the secondary server address.

This option uses a malformed or incomplete key definition that would not successfully authenticate zone transfer requests from the secondary server.

The correct BIND configuration defines a TSIG shared-secret key block and then references that key within an allow-transfer ACL targeting only the secondary server at 192.168.20.53, ensuring zone data is cryptographically authenticated and only transferred to the authorized recipient. TSIG uses HMAC algorithms (e.g., HMAC-SHA256) to sign each DNS message, preventing zone enumeration by unauthorized parties. The correct option uses the proper syntax pairing the key definition with a server or zone block that restricts transfers to 192.168.20.53 using that key.

This option either omits the allow-transfer restriction or references an incorrect server address, failing to limit secure transfers exclusively to 192.168.20.53.