559

pdf

School

Los Rios Colleges *

*We aren’t endorsed by this school

Course

Subject

Information Systems

Date

Oct 30, 2023

Type

pdf

Pages

Uploaded by klccc

10/25/23, 10 : 10 AM Page 1 of 17 https://labsimapp.testout.com/v6_0_574/exam-engine.html/b6f7e70f…n/30569520/da093e27-1fdf-4233-b328-414405d86bc9/end ? locale=en-us 5.5.9 Practice Questions Candidate: Kelsey Dusnmore (Kdusnmore) Date: 10/25/2023 10:07:53 am • Time Spent: 00:44 Score: 10% Passing Score: 80%  Question 1:  Incorrect You are the network administrator for westsim.com. The network consists of a single Active Directory domain. All of the servers run Windows Server 2016. All of the clients run Windows 10. Clients routinely access a web application on a server named web1.westsim.com. During the course of the business day, you receive complaints that users attempting to access web1.westsim.com were directed to an unknown °P address on the internet. They accessed a website that looked similar to the web application on web1.westsim.co, but were provided with no functionality. After researching the internet °P address, you fi nd it belongs to a group of attackers suspected of hacking into company websites. You determine that the compromise occurred because of DNS cache poisoning. To protect the server, you need to ensure that cache records on the DNS server cannot be overwritten until the Time to Live (TTL) period has expired. What should you do? You should implement the DNS cache locking feature. You should modify the Minimum (default) TTL value on the Start of Authority (SOA) record in the westsim.com zone. You should implement the Secure cache against pollution option. You should implement the DNS Socket Pool feature.

10/25/23, 10 : 10 AM Page 2 of 17 https://labsimapp.testout.com/v6_0_574/exam-engine.html/b6f7e70f…n/30569520/da093e27-1fdf-4233-b328-414405d86bc9/end ? locale=en-us Explanation You should implement the DNS Cache Locking feature. The DNS Cache Locking feature allows an administrator to lock the DNS cache. This means that cached records cannot be overwritten until their Time to Live (TTL) value expires. This protects the cache from hacking attempts to overwrite the legitimate cached records with incorrect values intended to direct clients to hacking servers so they can be compromised. You enable DNS Cache Locking using the Dnscmd /con fi g /cachelockingpercent PERCENT , where PERCENT is a number between 1-100. A value of 50 would prevent the entries in the cache from being overwritten until at least fi fty percent of the TTL had expired. The DNS Socket Pool feature is a feature that allows the DNS server to vary the ports it uses for DNS queries. This helps to protect the server against cache poisoning because a hacker would have di ﬃ culty poisoning the cache when they cannot predict which port will be used to receive the response to a DNS query. The Secure cache against pollution option also helps to prevent DNS cache poisoning. This option speci fi es that when a query for one domain (such as westsim.com) returns a referral to another domain (such as eastsim.com), the resulting record should not be cached in case it is not a legitimate record. While both of these options help protect against DNS cache poisoning, neither of them will prevent records already cached from being overwritten. The Minimum (default) TTL value on the Start of Authority (SOA) record speci fi es the TTL for records contained in that zone if they do not have a TTL con fi gured. You could adjust this value to ensure that records for the zone are cached for longer or shorter periods of time. This will not a ff ect whether or not the records can be overwritten once they are cached. References  5.5.1 DNS Protection Features  5.5.2 Con " gure DNS Security Extensions (DNSSEC)  5.5.3 Con " gure DNS Socket Pooling  5.5.4 Con " gure DNS Cache Locking  5.5.5 Enable Response Rate Limiting  5.5.6 Con " gure Delegated Administration 

10/25/23, 10 : 10 AM Page 3 of 17 https://labsimapp.testout.com/v6_0_574/exam-engine.html/b6f7e70f…n/30569520/da093e27-1fdf-4233-b328-414405d86bc9/end ? locale=en-us  5.5.7 DNS Protection Facts  5.5.8 Con " gure DNSSEC q_dns_protection_cache_locking_01_shc5.question.fex  Question 2:  Incorrect Which of the following helps prevent attacks that attempt to pollute information in the cache to direct tra ﬃ c to a malicious site? Response Rate Limiting DANE DNS cache locking DNS socket pooling Explanation DNS cache locking controls how long a cache entry is locked so it can't be overwritten. This helps prevent attacks that attempt to pollute information in the cache to direct tra ﬃ c to a malicious site. Response Rate Limiting helps protect a DNS server from denial-of-service attacks. DANE prevents on-path attacks, where attackers attempt to corrupt the DNS cache to point to their own website. DNS socket pool protects the DNS server. By default, a DNS server uses port 53 for DNS queries. This port is easy to attack. DNS socket pool con fi gures a pool of ports for the DNS to use for queries. References  5.5.1 DNS Protection Features  5.5.2 Con " gure DNS Security Extensions (DNSSEC) 

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

10/25/23, 10 : 10 AM Page 4 of 17 https://labsimapp.testout.com/v6_0_574/exam-engine.html/b6f7e70f…n/30569520/da093e27-1fdf-4233-b328-414405d86bc9/end ? locale=en-us  5.5.3 Con " gure DNS Socket Pooling  5.5.4 Con " gure DNS Cache Locking  5.5.5 Enable Response Rate Limiting  5.5.6 Con " gure Delegated Administration  5.5.7 DNS Protection Facts  5.5.8 Con " gure DNSSEC q_dns_protection_cache_locking_02_shc5.question.fex  Question 3:  Incorrect You are the network administrator for eastsim.com. The network consists of a single Active Directory domain. All of the servers run Windows Server 2016 Standard edition. All of the clients run Windows 10. A domain controller named DC1 functions as a DNS server that hosts a standard primary zone, eastsim.com. All of the other domain controllers host standard secondary zones for eastsim.com. A new corporate directive requires that all DNS communication be secure. The DNS records must be cryptographically signed by the DNS server so that clients can validate that the DNS server responses are authentic and have not been subject to tampering. You must con fi gure DNS to comply with the new policy. What should you do? Change the eastsim.com zone to an Active Directory-integrated zone. °mplement DNS Security Extensions (DNSSEC). °mplement a domain-based °PSec policy that requires that all DNS tra ﬃ c be encrypted. Upgrade the servers to Windows 2016 Datacenter edition.

10/25/23, 10 : 10 AM Page 5 of 17 https://labsimapp.testout.com/v6_0_574/exam-engine.html/b6f7e70f…n/30569520/da093e27-1fdf-4233-b328-414405d86bc9/end ? locale=en-us Explanation °mplement DNS Security Extensions (DNSSEC). The ability to create DNS Security Extensions (DNSSEC) was introduced in Windows Server 2008 R2. DNSSEC allows a DNS zone and all the records in the zone to be cryptographically signed. When a DNS server receives a query, it returns the digital signatures in addition to the records. The computer where the query originated can obtain the public key of the DNS server and validate that the responses are authentic and have not been subject to tampering. Changing the zone to an Active Directory-integrated zone will ensure that all zone transfers are encrypted. By default, Active Directory-integrated zones use Active Directory replication to transfer DNS information. Active Directory replication is encrypted using the Kerberos protocol. °mplementing a domain-based °PSec policy and requiring that all DNS tra ﬃ c be encrypted will ensure secure DNS communication. However, neither of these options results in the records being cryptographically signed. All versions of Windows Server 2016 have the same DNS features; they all support DNSSEC. There is no advantage to upgrading the edition of Windows Server 2016 in this particular scenario. References  5.5.1 DNS Protection Features  5.5.2 Con " gure DNS Security Extensions (DNSSEC)  5.5.3 Con " gure DNS Socket Pooling  5.5.4 Con " gure DNS Cache Locking  5.5.5 Enable Response Rate Limiting  5.5.6 Con " gure Delegated Administration  5.5.7 DNS Protection Facts  5.5.8 Con " gure DNSSEC q_dns_protection_dnssec_01_shc5.question.fex

10/25/23, 10 : 10 AM Page 6 of 17 https://labsimapp.testout.com/v6_0_574/exam-engine.html/b6f7e70f…n/30569520/da093e27-1fdf-4233-b328-414405d86bc9/end ? locale=en-us  Question 4:  Incorrect You are responsible for managing a Windows Server 2016 system named DNS1 that functions as a DNS server. One of the domains owned by your organization is westsim.com, which is not integrated with Active Directory. Your DNS server is authoritative for this zone. Two other DNS servers in your organization named DNS2 and DNS3 contain a copy of the zone data in a multi-master con fi guration. You want to use DNSSEC to sign zone data digitally. You want to use DNS1 as the Key Master for DNSSEC. Which should you do? °n DNS Manager, right-click the westsim.com zone and click DNSSEC > Sign the Zone. °n DNS Manager, right-click the westsim.com zone, click Properties, and then enable DNSSEC on the Zone Transfers tab. °n DNS Manager, right-client the westsim.com zone and click Key Master. °n DNS Manager, right-click the westsim.com zone, click Properties, and then enable DNSSEC on the Security tab. Explanation

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

10/25/23, 10 : 10 AM Page 7 of 17 https://labsimapp.testout.com/v6_0_574/exam-engine.html/b6f7e70f…n/30569520/da093e27-1fdf-4233-b328-414405d86bc9/end ? locale=en-us To sign a zone using DNSSEC, right-click the zone in DNS Manager and click DNSSEC > Sign the Zone. The Zone Signing Wizard is displayed and allows you to: °dentify the Key Master server. Create the key signing key (KSK). Create the zone signing key (ZSK). Starting with Windows Server 2012 R2, the Key Master role can manage the keys used by fi le-based zones with DNSSEC protection enabled. The Zone Transfers tab in the Properties of a DNS zone is used to specify which servers are authorized for zone transfers. The Security tab in the Properties of a DNS zone is used to manage zone permissions. The DNSSEC Properties of a zone can't be accessed until after the zone has been digitally signed. References  5.5.1 DNS Protection Features  5.5.2 Con " gure DNS Security Extensions (DNSSEC)  5.5.3 Con " gure DNS Socket Pooling  5.5.4 Con " gure DNS Cache Locking  5.5.5 Enable Response Rate Limiting  5.5.6 Con " gure Delegated Administration  5.5.7 DNS Protection Facts  5.5.8 Con " gure DNSSEC q_dns_protection_dnssec_02_shc5.question.fex  Question 5:  Incorrect Which of the following veri fi es that a server's response was not changed in transit and that the server sending the response is really who it claims to be?

10/25/23, 10 : 10 AM Page 8 of 17 https://labsimapp.testout.com/v6_0_574/exam-engine.html/b6f7e70f…n/30569520/da093e27-1fdf-4233-b328-414405d86bc9/end ? locale=en-us DNSSEC DNS socket pooling DANE DNS cache locking Explanation DNS Security Extensions (DNSSEC) is designed to protect the DNS client. °t veri fi es that a server's response was not changed in transit and that the server sending the response is really who it claims to be. DANE works with DNSSEC to allow DNS clients to verify that domain name certi fi cates are from the proper certi fi cation authority. DNS cache locking controls how long a cache entry is locked so that it can't be overwritten. DNS socket pool protects the DNS server. References  5.5.1 DNS Protection Features  5.5.2 Con " gure DNS Security Extensions (DNSSEC)  5.5.3 Con " gure DNS Socket Pooling  5.5.4 Con " gure DNS Cache Locking  5.5.5 Enable Response Rate Limiting  5.5.6 Con " gure Delegated Administration  5.5.7 DNS Protection Facts  5.5.8 Con " gure DNSSEC q_dns_protection_dnssec_03_shc5.question.fex

10/25/23, 10 : 10 AM Page 9 of 17 https://labsimapp.testout.com/v6_0_574/exam-engine.html/b6f7e70f…n/30569520/da093e27-1fdf-4233-b328-414405d86bc9/end ? locale=en-us  Question 6:  Incorrect You are the network administrator for corpnet.com. A new corporate policy requires that DNSSEC be implemented on the corpnet.com zone. A server named DNS1 is authoritative for the corpnet.com zone. You sign the corpnet.com zone and distribute trust anchors to all non-authoritative DNS servers that will perform DNSSEC validation of data from the zone. You need to prepare the clients to perform DNSSEC validation for the corpnet.com. What should you do? Con fi gure the properties of the DNS server. Con fi gure the DNS tab in the Advanced properties of TCP/°Pv4. Con fi gure the properties of the corpnet.com zone. °n Group Policy, con fi gure a Name Resolution Policy. Explanation

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

10/25/23, 10 : 10 AM Page 10 of 17 https://labsimapp.testout.com/v6_0_574/exam-engine.html/b6f7e70f…/30569520/da093e27-1fdf-4233-b328-414405d86bc9/end ? locale=en-us °n Group Policy, you should con fi gure a Name Resolution Policy. When you con fi gure a Name Resolution Policy in Group Policy, it populates the client's Name Resolution Policy Table (NRPT). The NRPT is a table of namespaces and corresponding settings stored in the Windows Registry that determines the DNS client's behavior when issuing queries and processing responses. °t's used in DNSSEC and also for DirectAccess. The Name Resolution Policy can be used to create an entry for the speci fi c domain that instructs the clients to check for DNSSEC validation in any DNS responses for that domain. You can con fi gure the DNS tab in the Advanced properties of TCP/°Pv4 to control various aspects of the client's DNS services, such as adding a DNS Su ﬃ x Search List or specifying whether the client should register a connection-speci fi c DNS su ﬃ x. The properties of a DNS zone can be used to con fi gure zone transfers, integration with W°NS, and the SOA record. The properties of the DNS server provide options for the server, including Advanced settings and DNS Debug Logging. References  5.5.1 DNS Protection Features  5.5.2 Con " gure DNS Security Extensions (DNSSEC)  5.5.3 Con " gure DNS Socket Pooling  5.5.4 Con " gure DNS Cache Locking  5.5.5 Enable Response Rate Limiting  5.5.6 Con " gure Delegated Administration  5.5.7 DNS Protection Facts  5.5.8 Con " gure DNSSEC q_dns_protection_policy_shc5.question.fex

10/25/23, 10 : 10 AM Page 11 of 17 https://labsimapp.testout.com/v6_0_574/exam-engine.html/b6f7e70f…/30569520/da093e27-1fdf-4233-b328-414405d86bc9/end ? locale=en-us  Question 7:  Incorrect What is the default pool size of ports for Windows Server 2022? 2300 2500 2400 2600 Explanation DNS socket pooling is enabled by default on all modern Windows Server systems. Windows Server 2022 DNS has a default pool size of 2500 ports. References  5.5.1 DNS Protection Features  5.5.2 Con " gure DNS Security Extensions (DNSSEC)  5.5.3 Con " gure DNS Socket Pooling  5.5.4 Con " gure DNS Cache Locking  5.5.5 Enable Response Rate Limiting  5.5.6 Con " gure Delegated Administration  5.5.7 DNS Protection Facts  5.5.8 Con " gure DNSSEC q_dns_protection_pool_size_shc5.question.fex  Question 8:  Correct

10/25/23, 10 : 10 AM Page 12 of 17 https://labsimapp.testout.com/v6_0_574/exam-engine.html/b6f7e70f…/30569520/da093e27-1fdf-4233-b328-414405d86bc9/end ? locale=en-us You are the network administrator for westsim.com. The network consists of a single Active Directory domain. All the servers run Windows Server 2016. All the clients run Windows 10. The company has one main o ﬃ ce. There is one server named DNS1 with the DNS Server role installed. A new company security directive states that servers should not use port 49308. All other port ranges are acceptable and should not be excluded. You need to con fi gure DNS1 to adhere to the new security requirement without any loss of DNS functionality. What should you do? You should set the SocketPoolExcludedPortRanges setting in the registry on the DNS servers to 49308-49308. You should create two new rules in the Windows Firewall with Advanced Security, one inbound and one outbound, blocking port 49308. You should set the SocketPoolSize setting in the registry on the DNS server to 49307. You should set the SocketPoolExcludedPortRanges setting in the registry on the DNS servers to 49307-49309. Explanation

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

10/25/23, 10 : 10 AM Page 13 of 17 https://labsimapp.testout.com/v6_0_574/exam-engine.html/b6f7e70f…/30569520/da093e27-1fdf-4233-b328-414405d86bc9/end ? locale=en-us You should set the SocketPoolExcludedPortRanges setting in the registry on the DNS servers to 49308-49308 . The DNS Socket Pool allows the DNS servers to use source port randomization when sending DNS queries in order to protect the DNS server from Cache Poisoning. °n order for an attacker to send erroneous information back to the DNS server, they would need to guess the port being used for the query. You would use the SocketPoolExcludedPortRanges to exclude any ports you do not want to be used for Socket Pooling. The setting is located in the HKEY_LOCAL_MACH°NE\SYSTEM\CurrentControlSet\services\DNS\Parameters key in the registry. °f you need to exclude just one port, you would set the start and the end of the exclusion to the same port number. Therefore, you should exclude the range 49308- 49308 . Setting the SocketPoolExcludedPortRanges to 49307-49309 would exclude ports 49307, 49308, and 49309. However, the company directive states that no other port besides port 49308 should be excluded. The SocketPoolSize setting in the registry is used to specify the number of random ports that can be used by the DNS server. The default size of the pool is 2500 ports. You can set up to 10,000 ports, and the port numbers can range from 0 to 65535 . Changing the size of the Socket Pool to 49308 will result in the DNS server attempting to use more than the maximum of 10,000. °t will not ensure that port 49308 is excluded from that range. Creating two new rules that block port 49308 for both inbound and outbound tra ﬃ c will result in any DNS tra ﬃ c sent on that port being blocked by the fi rewall. References  5.5.1 DNS Protection Features  5.5.2 Con " gure DNS Security Extensions (DNSSEC)  5.5.3 Con " gure DNS Socket Pooling  5.5.4 Con " gure DNS Cache Locking  5.5.5 Enable Response Rate Limiting  5.5.6 Con " gure Delegated Administration  5.5.7 DNS Protection Facts  5.5.8 Con " gure DNSSEC

10/25/23, 10 : 10 AM Page 14 of 17 https://labsimapp.testout.com/v6_0_574/exam-engine.html/b6f7e70f…/30569520/da093e27-1fdf-4233-b328-414405d86bc9/end ? locale=en-us q_dns_protection_socketpool_01_shc5.question.fex  Question 9:  Incorrect Which of the following commands allow you to view the socket pool size? (Select two.) C:\>(Get- DnsServer).ServerSetting.SocketPoolSize C:\>dnscmd /info /socketpoolsize 2500 C:\>dnscmd /con fi g /socketpoolsize 2500 C:\>(Get- DnsServer).ServerSetting.SocketPoolSize 2500 C:\>dnscmd /info /socketpoolsize Explanation To view the socket pool size at the command prompt use C:\>dnscmd /info /socketpoolsize . To view the socket pool size using a cmdlet enter C:\>(Get- DnsServer).ServerSetting.SocketPoolSize . The command to change the socket pool size is C:\>dnscmd /con fi g /socketpoolsize <number of ports> . The cmdlet to change the socket pool size is more complicated than Command Prompt. A variable is used to store the new pool size value, which is then piped, or sent, to a cmdlet that sets the new value: C:\>$DNSPoolSetting = New-Cim°nstance -Namespace root/Microsoft/Windows/Dns ClassName DNSServerSetting -Property @{SocketPoolSize = [uint32]<pool size>} - ClientOnly | Set-DnsServerSetting References 

10/25/23, 10 : 10 AM Page 15 of 17 https://labsimapp.testout.com/v6_0_574/exam-engine.html/b6f7e70f…/30569520/da093e27-1fdf-4233-b328-414405d86bc9/end ? locale=en-us  5.5.1 DNS Protection Features  5.5.2 Con " gure DNS Security Extensions (DNSSEC)  5.5.3 Con " gure DNS Socket Pooling  5.5.4 Con " gure DNS Cache Locking  5.5.5 Enable Response Rate Limiting  5.5.6 Con " gure Delegated Administration  5.5.7 DNS Protection Facts  5.5.8 Con " gure DNSSEC q_dns_protection_socketpool_02_shc5.question.fex  Question 10:  Incorrect You are the network administrator for Corpnet.com. The company has three domains named corpnet.com, east.corpnet.com, and west.corpnet.com. The DNS servers in each domain are only authoritative for the zones for their domains and are all member servers. You sign the corpnet.com DNS zone with DNSSEC. You need to enable the DNS servers that are not authoritative for the corpnet.com zone to perform DNSSEC validation of DNS responses for the corpnet.com zone. What should you do? °n Group Policy, con fi gure a Name Resolution Policy. Change the Replication Scope of the corpnet.com DNS zone. Distribute a Trust Anchor to all DNS servers that are not authoritative for the corpnet.com zone.

Your preview ends here

Eager to read complete document? Join bartleby learn and gain access to the full version

Access to all documents
Unlimited textbook solutions
24/7 expert homework help

10/25/23, 10 : 10 AM Page 16 of 17 https://labsimapp.testout.com/v6_0_574/exam-engine.html/b6f7e70f…/30569520/da093e27-1fdf-4233-b328-414405d86bc9/end ? locale=en-us Convert the corpnet.com zone to Active Directory-integrated. Explanation You should distribute a Trust Anchor to all DNS servers that are not authoritative for the corpnet.com zone. The DNSKEY and DS records are also called Trust Anchors. The DNSKEY stores a public cryptographic key used to verify a signature during the validation process. A DS record is a DNSSEC record type used to secure a delegation. A trust anchor must be distributed to all non-authoritative DNS servers that will perform DNSSEC validation of DNS responses for a signed zone. °f the DNS server is running on a domain controller, trust anchors are stored in the forest directory partition in Active Directory Domain Services (AD DS) and can be replicated to all domain controllers in the forest. Since all of the DNS servers in the company are member servers, the trust anchors must be distributed manually. When you con fi gure a Name Resolution Policy in Group Policy, it populates the client's Name Resolution Policy Table (NRPT). The NRPT is a table of namespaces and corresponding settings stored in the Windows Registry that determines the DNS client's behavior when issuing queries and processing responses. °t's used in DNSSEC and also for DirectAccess. The Name Resolution Policy can be used to create an entry for the speci fi c domain that instructs the clients to check for DNSSEC validation in any DNS responses for that domain. References  5.5.1 DNS Protection Features  5.5.2 Con " gure DNS Security Extensions (DNSSEC)  5.5.3 Con " gure DNS Socket Pooling  5.5.4 Con " gure DNS Cache Locking  5.5.5 Enable Response Rate Limiting  5.5.6 Con " gure Delegated Administration  5.5.7 DNS Protection Facts  5.5.8 Con " gure DNSSEC

10/25/23, 10 : 10 AM Page 17 of 17 https://labsimapp.testout.com/v6_0_574/exam-engine.html/b6f7e70f…/30569520/da093e27-1fdf-4233-b328-414405d86bc9/end ? locale=en-us q_dns_protection_trust_anchor_shc5.question.fex Copyright © 2023 TestOut Corporation All rights reserved.