nerdexam
Linux_Foundation

LFCS · Question #385

What are the steps which must be followed to enable serverwide zone transfers between two BIND 9 servers securely using TSIG?

The correct answer is B. Generate a key, specify the private key in the named configuration on both servers, create a server. To secure BIND 9 zone transfers with TSIG, a shared secret key must be generated once and then securely configured as the private key on both the primary and secondary DNS servers.

Submitted by ravi_2018· Apr 18, 2026Service Configuration

Question

What are the steps which must be followed to enable serverwide zone transfers between two BIND 9 servers securely using TSIG?

Options

  • AGenerate a key, specify the public key in the named configuration on both servers, create a server
  • BGenerate a key, specify the private key in the named configuration on both servers, create a server
  • CGenerate a key, specify the private key in the named configuration on one server and the public key
  • DGenerate a key, specify the private key in the named configuration on one server and the public key

How the community answered

(13 responses)
  • A
    15% (2)
  • B
    69% (9)
  • C
    8% (1)
  • D
    8% (1)

Why each option

To secure BIND 9 zone transfers with TSIG, a shared secret key must be generated once and then securely configured as the private key on both the primary and secondary DNS servers.

AGenerate a key, specify the public key in the named configuration on both servers, create a server

TSIG uses a shared *secret* key, not a public/private key pair in the typical asymmetric sense for authentication during zone transfers; specifying a "public key" would be incorrect.

BGenerate a key, specify the private key in the named configuration on both servers, create a serverCorrect

TSIG (Transaction Signature) uses shared secret key cryptography to authenticate DNS messages, including zone transfers. A single key is generated and must be known as a "private key" (secret key) to both the primary (source) and secondary (destination) BIND servers involved in the transfer to ensure mutual authentication and integrity.

CGenerate a key, specify the private key in the named configuration on one server and the public key

TSIG uses a symmetric shared secret key; it's not a public/private key cryptography scheme where one server has a private and the other a public key. Both servers need the identical shared secret key.

DGenerate a key, specify the private key in the named configuration on one server and the public key

This option incorrectly describes TSIG as using an asymmetric key pair rather than a shared symmetric secret key.

Concept tested: BIND 9 TSIG zone transfer configuration

Source: https://bind9.readthedocs.io/en/latest/configuration.html#tsig-keys

Topics

#BIND#TSIG#DNS Zone Transfers#DNS Security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full LFCS Practice