A DNS forward lookup zone named comptia.org must: - Ensure the DNS is protected from on-path attacks. - Ensure zone transfers use mutual authentication and are authenticated and negotiated. Which of…

The correct answer is A. Public keys D. DNSSEC. By publishing the zone’s DNSSEC public keys (and configuring the parent zone and any secondary servers to trust them), zone transfers will automatically be integrity-checked and authenticated. The mutual authentication during zone transfers relies on the underlying public-key…

Submitted by joshua94· Mar 6, 2026Security Engineering

Question

A DNS forward lookup zone named comptia.org must:

Ensure the DNS is protected from on-path attacks.
Ensure zone transfers use mutual authentication and are authenticated

and negotiated. Which of the following should the security architect configure to meet these requirements? (Choose two).

Options

APublic keys
BConditional forwarders
CRoot hints
DDNSSEC
ECNAME records
FSRV records

How the community answered

(29 responses)

A
76% (22)
B
14% (4)
C
3% (1)
F
7% (2)

Explanation

By publishing the zone’s DNSSEC public keys (and configuring the parent zone and any secondary servers to trust them), zone transfers will automatically be integrity-checked and authenticated. The mutual authentication during zone transfers relies on the underlying public-key signatures that DNSSEC provides. Deploying DNSSEC for the comptia.org zone signs all records with cryptographic signatures and publishes the corresponding public keys, protecting against on-path tampering and spoofing.

Community Discussion

No community discussion yet for this question.

Full CAS-005 Practice