Exam SY0-601 topic 1 question 194 discussion

A zone file is a text based file with a format defined in RFC 1035 and 1034 and is stored on a DNS server (name server). Zone files contain the IP and name data, MX records and other service records. They also contain glue data that connects them to the other DNS servers.The default behavior for DNS zone transfer permits any host to request and receive a full zone transfer for a Domain. This is a security issue since DNS data can be used to decipher the topology of a company’s network. The information obtained can be used for malicious exploitation such as DNS poisoning/spoofing. This is like an anonymous person calling the receptionist to request and receive the entire company’s telephone and address book. https://www.giac.org/paper/gsec/2668/securing-dns-zone-transfer/104562

Domain Name System Security Extensions (DNSSEC) is a set of specifications that extend the DNS protocol by adding cryptographic authentication

DNSSEC is a suite of extensions to DNS that provides validation for DNS responses. It adds a Resource Record Signature (RRSIG), commonly referred to as a digital signature, to each record. The RRSIG provides data integrity and authentication for DNS replies. If a DNS server receives a DNSSECenabled response with digitally signed records, the DNS server knows that the response is valid.

DNSSEC (Domain Name System Security Extensions) is a suite of extensions to DNS that adds an extra layer of security to the DNS infrastructure. One of the key features of DNSSEC is to provide a mechanism for validating and checking the integrity of zone transfers between DNS servers. It helps to prevent DNS spoofing and other attacks that can occur during zone transfers by ensuring the authenticity and integrity of DNS data. By implementing DNSSEC, the organization can enhance the security of its DNS infrastructure and protect against potential attacks that might exploit vulnerabilities in zone transfers.

"Domain Name System Security Extensions (DNSSEC) A suite of security extensions proposed and used by the US government and other entities that allows for secure DNS queries and zone transfers. DNSSEC provides the capability to authenticate DNS information from known and trusted servers." -Mike Meyers Security+ Certification Guide SY0-601 Third Edition

Zone transfers - DNS related. Agree with A being the correct answer here.

correct