A company's external DNS server was used by an attacker in a DDoS attack against a third party. Which of the following configurations should be changed to prevent this from happening again?

Question

Options

• ADisable recursive DNS queries on the server
• BDo not allow TCP to be used for large DNS queries
• CRequire DNSSEC for DNS zone transfers
• DRemove the forward lookup zone on the server

• A
  78% (47)
• B
  5% (3)
• C
  13% (8)
• D
  3% (2)

Explanation

To launch an amplified DNS DoS attack, the bad guys first locate several DNS servers that will perform recursive look-ups on behalf of anyone on the Internet (a large majority of DNS servers have this configuration in the wild). Next, the attacker sends queries to those servers for a DNS record that the attacker controls on the attacker's own DNS server. Because they are configured for recursion, these DNS servers send the request back to the attacker, who responds with a 4000- byte TXT record, which will be cached in the DNS servers that will be used for DNSSEC for zone transfers, using TCP for large queries and forward lookup zones do not make a DNS server vulnerable or useful in launching DNS attacks of this nature.

No community discussion yet for this question.