Study. uk . com
  1. Home
  2. All questions
  3. Question 287

CISSP study material · question 287 of 500

A team proposes DNSSEC to stop an eavesdropper reading which sites employees look up. Why does this fail?

  1. DNSSEC encrypts only zone transfers, not queries.
  2. DNSSEC protects only the last hop between stub and recursive resolver.
  3. DNSSEC requires the resolver to hold a trust anchor for every zone queried.
  4. DNSSEC supplies origin authentication and integrity plus key distribution, and deliberately provides no confidentiality.
Show the answer

Answer: D. DNSSEC supplies origin authentication and integrity plus key distribution, and deliberately provides no confidentiality.

The extensions authenticate the origin of records and protect their integrity, and distribute keys; secrecy of the query or answer is outside what they do.

Source: RFC 4033 (IETF) — RFC 4033 > 1. Introduction

Challenge yourself on this topic → Study as cards