220-1102 Question 572
Single answerSecure DNSA small business wants to reduce the risk of users being redirected to malicious websites through forged DNS responses while they are connected to public Wi-Fi. The technician cannot modify external DNS servers but can change settings on company-managed laptops and the browser configuration. Which solution best addresses this risk?
- A
Enable DNS over HTTPS (DoH) on the managed laptops and use a trusted DNS provider that supports it
- B
Configure a larger local DNS cache on each laptop so responses are reused longer
- C
Disable IPv6 on the laptops so only IPv4 DNS requests are sent
- D
Add static entries to the hosts file for all commonly used websites
Show answer and explanation
Correct answer: A
Explanation
The best answer is to enable DNS over HTTPS (DoH) on the managed laptops. In an A+ Core 2 context, secure DNS commonly refers to using encrypted DNS methods such as DoH to protect name resolution from eavesdropping and manipulation, especially on untrusted networks like public Wi-Fi. Because the technician cannot change external DNS servers, endpoint-based configuration is the most realistic control. This aligns with industry best practices from browser vendors and operating system guidance that support encrypted DNS to improve privacy and integrity of DNS queries in transit. Larger caches, disabling IPv6, and widespread hosts file entries do not provide the same protection against forged DNS responses. Note that DNSSEC is also a secure DNS technology, but it requires support and proper configuration on the DNS infrastructure side, which is outside the technician's control in this scenario.
- A. Correct.
Correct. DNS over HTTPS (DoH) encrypts DNS queries between the client and the DNS resolver, helping prevent local network observers or attackers on untrusted networks from viewing or tampering with DNS requests in transit. In this scenario, the company cannot control external DNS infrastructure, so enabling DoH on endpoints is a practical client-side mitigation for forged or intercepted DNS traffic on public Wi-Fi.
- B. Incorrect.
Incorrect. Increasing the local DNS cache duration may reduce the number of outbound DNS queries, but it does not secure DNS traffic when queries do occur. It also risks stale name resolution data and does not protect against spoofed responses on an untrusted network.
- C. Incorrect.
Incorrect. Disabling IPv6 does not secure DNS. DNS can still be queried over IPv4 and remain vulnerable to interception or spoofing if not otherwise protected. This option reflects a common misconception that turning off IPv6 improves general network security in cases where the actual issue is unencrypted DNS traffic.
- D. Incorrect.
Incorrect. Static hosts file entries may work for a very small number of internal or fixed systems, but they are not a practical or secure solution for all commonly used websites. Public web services frequently change IP addresses, use CDNs, and rely on load balancing. Maintaining host entries at scale would cause reliability issues and would not provide broad secure DNS functionality.