Which two DNS policy actions in the anti-spyware security profile can prevent hacking attacks through DNS queries to malicious domains? (Choose two.)

The correct answer is B. Sinkhole D. Block. A DNS policy action is a setting in an Anti-Spyware security profile that defines how the firewall handles DNS queries to malicious domains. A malicious domain is a domain name that is associated with a known threat, such as malware, phishing, or botnet. There are four possible D

Threat Prevention

Question

Options

ADeny
BSinkhole
COverride
DBlock

How the community answered

(42 responses)

A
14% (6)
B
79% (33)
C
7% (3)

Explanation

A DNS policy action is a setting in an Anti-Spyware security profile that defines how the firewall handles DNS queries to malicious domains. A malicious domain is a domain name that is associated with a known threat, such as malware, phishing, or botnet. There are four possible DNS policy actions: alert, allow, block, and sinkhole. The alert action logs the DNS query and allows it to proceed to the intended destination. This action does not prevent hacking attacks, but only notifies the administrator of the potential threat. The allow action allows the DNS query to proceed to the intended destination without logging it. This action does not prevent hacking attacks, but only bypasses the DNS security inspection. The block action blocks the DNS query and sends a response to the client with an NXDOMAIN (non- existent domain) error code. This action prevents hacking attacks by preventing the client from resolving the malicious domain. The sinkhole action redirects the DNS query to a predefined IP address (the sinkhole IP address) that is under the control of the administrator. This action prevents hacking attacks by isolating the client from the malicious domain and allowing the administrator to monitor and remediate the

Topics

#DNS security#anti-spyware#DNS sinkhole#malicious domains

Community Discussion

No community discussion yet for this question.

Full NETSEC-ANALYST Practice