SY0-701 Question 328
Single answerDNS filteringA company recently had several users click links in phishing emails that led to newly registered domains hosting credential-harvesting pages. The security team wants a control that can be deployed quickly across all offices and remote users to reduce successful connections to known malicious and high-risk domains before a web session is established. Which solution best meets this requirement?
- A
Implement DNS filtering using a protective recursive DNS service that blocks requests to malicious, newly registered, and policy-violating domains
- B
Enable DNSSEC validation on the organization’s DNS resolvers to prevent users from reaching phishing websites
- C
Deploy split-horizon DNS so internal and external users receive different DNS answers for the company’s domains
- D
Require all public web applications to use a web application firewall (WAF) to stop outbound connections to phishing sites
Show answer and explanation
Correct answer: A
Explanation
DNS filtering is the best fit because it blocks access at the name-resolution stage, often before a browser can connect to a malicious site. In practice, organizations commonly use protective DNS services or secure recursive resolvers that enforce category-based policies and threat-intelligence feeds for phishing, malware, command-and-control, and newly observed domains. This is especially effective for broad, rapid deployment because the control can be applied centrally through network DNS settings, DHCP, VPN profiles, or endpoint agents for roaming users. By contrast, DNSSEC is important for validating DNS data authenticity but does not classify domains as safe or unsafe. Split-horizon DNS is a namespace management technique, not a filtering control. A WAF protects hosted applications, not end users browsing outbound. These distinctions align with common security best practices from sources such as NIST guidance on protective DNS and DNS security, which differentiate DNS integrity protections from policy-based DNS blocking.
- A. Correct.
Correct. DNS filtering is designed to inspect and control DNS queries before users connect to a destination. A protective recursive DNS service can block resolution of domains associated with malware, phishing, command-and-control infrastructure, or newly registered/high-risk domains based on threat intelligence and policy. This aligns with the requirement to stop access before a web session is established and can often be rolled out quickly by changing endpoint, DHCP, VPN, or network DNS settings for both office and remote users.
- B. Incorrect.
Incorrect. DNSSEC helps validate the authenticity and integrity of DNS responses and protects against certain attacks such as DNS spoofing or cache poisoning. However, DNSSEC does not determine whether a domain is malicious or phishing-related. A phishing site can be hosted on a perfectly valid, DNSSEC-signed domain, so enabling DNSSEC alone would not meet the requirement to block known malicious or high-risk domains.
- C. Incorrect.
Incorrect. Split-horizon DNS is used to provide different DNS answers based on the source of the request, commonly to separate internal and external views of the same namespace. It does not provide threat-based blocking of malicious destinations and would not address users clicking phishing links to external attacker-controlled domains.
- D. Incorrect.
Incorrect. A WAF protects web applications that the organization hosts by filtering and monitoring inbound HTTP/S traffic to those applications. It is not a control for preventing users from making outbound connections to phishing sites on the internet. Someone might choose this option because a WAF is web-related, but it is focused on protecting servers and applications rather than controlling user DNS resolution.