N10-009 Question 230
Select 2Name resolution: DNS (Domain Name System Security Extensions (DNSSEC), DNS over HTTPS (DoH) and DNS over TLS (DoT))A network administrator is securing client DNS traffic for remote employees who often use untrusted public Wi-Fi. The company wants to prevent local networks from viewing DNS queries in transit, while still using the organization's existing recursive DNS resolver. The security team also wants to validate that DNS records have not been tampered with by authoritative sources. Which TWO technologies should the administrator implement to best meet these requirements?
- A
Enable DNSSEC validation on the organization's recursive DNS resolver
- B
Configure clients to use DNS over HTTPS (DoH) or DNS over TLS (DoT) to the organization's recursive DNS resolver
- C
Replace DNS with LDAP because LDAP encrypts directory lookups by default
- D
Disable DNS caching so clients always query authoritative servers directly
- E
Use only split-horizon DNS, because it both encrypts DNS traffic and validates record authenticity
Show answer and explanation
Correct answers: A, B
Explanation
The scenario has two separate security goals: confidentiality of DNS queries in transit from remote clients, and integrity/authenticity of DNS responses. DoH or DoT protects client-to-resolver traffic from eavesdropping and some tampering on untrusted networks. DNSSEC validation on the recursive resolver verifies signed DNS data and helps detect forged or modified records. These technologies are complementary, not interchangeable: DoH/DoT encrypt transport, while DNSSEC validates DNS data. This aligns with IETF standards and operational best practices: DNSSEC is defined in RFCs such as 4033, 4034, and 4035; DNS over TLS is defined in RFC 7858; and DNS over HTTPS is defined in RFC 8484.
- A. Correct.
Correct. DNSSEC provides origin authentication and integrity validation for DNS data by using digital signatures. When the organization's recursive resolver performs DNSSEC validation, it can detect tampered or forged DNS responses from upstream authoritative data paths. This addresses the requirement to validate that DNS records have not been altered. DNSSEC does not encrypt DNS queries, so it is only part of the solution.
- B. Correct.
Correct. DoH and DoT encrypt DNS queries between the client and the configured recursive resolver, which helps protect DNS traffic from observation or modification on untrusted local networks such as public Wi-Fi. Using the organization's own resolver preserves administrative control and logging policy. DoH typically uses HTTPS over TCP 443, while DoT uses TLS over TCP 853.
- C. Incorrect.
Incorrect. LDAP is a directory access protocol, not a replacement for DNS name resolution on IP networks. Although LDAP can be protected with TLS, it does not provide standard hostname-to-IP resolution for client applications in place of DNS.
- D. Incorrect.
Incorrect. Disabling caching would increase query volume and reduce performance, and having clients query authoritative servers directly is not standard practice for most endpoints. It also does not provide encryption for queries on public Wi-Fi, nor does it replace DNSSEC validation at a recursive resolver.
- E. Incorrect.
Incorrect. Split-horizon DNS is used to present different DNS answers to different clients, typically internal versus external. It does not inherently encrypt DNS traffic, and it does not validate DNS record authenticity. Someone might choose this option because it is a DNS security-related configuration, but it does not meet the stated requirements.