Study. uk . com
  1. Home
  2. All questions
  3. Question 288

CISSP study material · question 288 of 500

How is a DNSSEC authentication chain built, according to RFC 4033?

  1. A single self-signed key at the root, replicated to every zone.
  2. Alternating DNSKEY record sets and delegation signer record sets, each delegation signer holding a hash that authenticates the next key.
  3. A chain of certificate authority certificates ending at a root certificate.
  4. A sequence of signatures over the query, each added by a resolver on the path.
Show the answer

Answer: B. Alternating DNSKEY record sets and delegation signer record sets, each delegation signer holding a hash that authenticates the next key.

An authentication chain is an alternating sequence of DNSKEY record sets and delegation signer record sets, with each delegation signer record containing a hash that authenticates the next key.

Source: RFC 4033 (IETF) — RFC 4033 > 2. Definitions of Important DNSSEC Terms

Challenge yourself on this topic → Study as cards