Study. uk . com
  1. Home
  2. All questions
  3. Question 291

CISSP study material · question 291 of 500

A resolver holds a trust anchor and a secure delegation, but the answer's signatures have expired. Which DNSSEC state results, and which other conditions produce it? Choose two.

  1. Insecure, since the expiry means the zone is no longer signed.
  2. Bogus, the state for an answer that fails validation despite a secure delegation.
  3. Signatures made with an algorithm the resolver does not support.
  4. No trust anchor covering that branch of the namespace.
Show the answer

Answer: C. Signatures made with an algorithm the resolver does not support.
B. Bogus, the state for an answer that fails validation despite a secure delegation.

Bogus covers a secure delegation whose data fails to validate: missing or expired signatures, unsupported algorithms, or data that the denial-of-existence record said should be present.

Source: RFC 4033 (IETF) — RFC 4033 > 5. Scope of the DNSSEC Document Set

Challenge yourself on this topic → Study as cards