SSCP · Question #1204
BIND should be disabled on which of the following?
The correct answer is B. All non DNS servers. BIND (Berkeley Internet Name Domain) should be disabled on all non-DNS servers to reduce the attack surface and prevent unnecessary exposure to potential vulnerabilities.
Question
BIND should be disabled on which of the following?
Options
- AAll DNS servers to avoid recursive lookups
- BAll non DNS servers
- CFirewalls
- DRouters
How the community answered
(53 responses)- A4% (2)
- B94% (50)
- C2% (1)
Why each option
BIND (Berkeley Internet Name Domain) should be disabled on all non-DNS servers to reduce the attack surface and prevent unnecessary exposure to potential vulnerabilities.
Disabling BIND on all DNS servers would prevent them from performing their primary function of resolving domain names.
BIND is DNS server software, and running it on servers that are not designated as DNS servers creates an unnecessary attack surface, consuming resources and potentially exposing the system to vulnerabilities. Disabling it on all non-DNS servers is a critical security hardening step.
While firewalls typically perform DNS lookups, they usually use client-side DNS resolution, not by running a full BIND server themselves; disabling BIND on a firewall is generally not the primary concern, rather ensuring it doesn't run unnecessarily.
Routers perform routing functions and may forward DNS requests, but they typically don't run a full BIND server; disabling BIND on routers is not a universally applicable security recommendation in the same way as on general non-DNS servers.
Concept tested: DNS server hardening
Topics
Community Discussion
No community discussion yet for this question.