Users of a cloud-hosted service are being sent to a malicious site by forged DNS responses injected into resolver caches. The operations team proposes deploying DNSSEC for the service's zones. What does DNSSEC provide in this case?
Select an answer to reveal the explanation.
Short Explanation
DNSSEC is a tamper-evident seal on DNS answers, not an envelope around them. A validating resolver checks the signature, and a forged answer just doesn't pass. The trap is thinking it hides your queries; for privacy, that's a different tool entirely.
Full Explanation
DNS Security Extensions add digital signatures to DNS records. The zone owner signs its record sets, publishes the public keys, and links them to the parent zone through a chain of trust up to the root. A validating resolver checks the signatures on each answer; if a record has been forged or altered, such as in a cache poisoning attack, validation fails and the resolver discards it. DNSSEC therefore provides data origin authentication and data integrity, which directly counters the forged-response attack in the scenario. It does not encrypt queries or responses; record contents and the names being resolved remain visible on the network, and privacy requires separate mechanisms such as DNS over TLS or HTTPS. DNSSEC also does not provide availability protection; signed responses are larger, and rate limiting or denial-of-service defences are separate controls. Nor does it authenticate end users; it authenticates the data and its source zone, not the person or device asking the question, and access to internal names is controlled by split-horizon design and resolver access lists. Exam caveat: protection depends on resolvers actually performing validation; signing the zone alone does nothing for clients whose resolvers ignore signatures. Operational check: confirm that the zone is signed with a valid chain of trust from the parent, that the organization's resolvers have validation enabled, and that a deliberately mis-signed test record is rejected.