CAS-003 · Question #672
A company wants to implement a cloud-based security solution that will sinkhole malicious DNS requests. The security administrator has implemented technical controls to direct DNS requests to the…
The correct answer is D. Implement policy routing as follows. Policy-based routing (PBR) allows the network to intercept all outbound DNS traffic (UDP/TCP port 53) at the network layer and redirect it to the cloud sinkhole servers, regardless of what DNS server address is manually configured on an endpoint. This enforces DNS redirection…
Question
A company wants to implement a cloud-based security solution that will sinkhole malicious DNS requests. The security administrator has implemented technical controls to direct DNS requests to the cloud servers but wants to extend the solution to all managed and unmanaged endpoints that may have user-defined DNS manual settings. Which of the following should the security administrator implement to ensure the solution will protect all connected devices?
Options
- AImplement firewall ACLs as follows
- BImplement NAT as follows:
- CImplement DHCP options as follows:
- DImplement policy routing as follows:
How the community answered
(40 responses)- A10% (4)
- B18% (7)
- C5% (2)
- D68% (27)
Explanation
Policy-based routing (PBR) allows the network to intercept all outbound DNS traffic (UDP/TCP port 53) at the network layer and redirect it to the cloud sinkhole servers, regardless of what DNS server address is manually configured on an endpoint. This enforces DNS redirection transparently at the infrastructure level, ensuring even unmanaged devices or users who override DHCP-provided DNS settings are still protected. DHCP options (C) only push DNS settings to devices that accept them - manual overrides bypass this. Firewall ACLs (A) can block alternate DNS but cannot redirect. NAT (B) can redirect ports but policy routing is the more direct and scalable mechanism for this use case.
Topics
Community Discussion
No community discussion yet for this question.