Review Questions

1.	Which DNS security policy specifies that zone transfers are only allowed to specific IP addresses? Low-level Mid-level High-level Secure-level
2.	You want to control the replication of WINS records so that they replicate every hour . What type of replication should you use? Push Pull Time-initiated Dynamic
3.	What DNS options allow you to direct client queries to servers that are authoritative for a zone? (Choose all that apply.) Primary zones Stub zones Delegations Zone transfers
4.	Which zone type is used to identify a server that is authoritative for a zone, and will automatically retrieve the SOA record for the zone, the NS records for the name servers within the zone, and the A records for those name servers? Delegation Primary zone Secondary zone Stub zone
5.	How does WINS interoperate with DHCP? The DHCP server assigns the WINS server address and node type options to clients . The DHCP server registers the computer name of clients within the WINS database. The WINS server provides remote clients with access to the DHCP server. The WINS server receives IP address information from the DHCP server and then passes the address information to the client.
6.	To which of the following types of attacks are DNS servers susceptible? (Choose all that apply.) Footprinting Data modification Denial of Service Redirection
7.	Becca is designing her name resolution infrastructure and is trying to determine how she is going to design the DNS solution for Active Directory. She plans on installing several Windows Server 2003 domain controllers and she wants to take advantage of Active Directory “integrated zones. Which of the following DNS server types will accommodate her needs? UNIX BIND 8.1.2 UNIX BIND 9.1.0 Windows NT 4 Windows Server 2003
8.	Leon is designing the DNS infrastructure and need to determine the namespace that will be used for his organization. The design calls for a back-to-back firewall to define a perimeter network and protect the internal network. Currently the organization is using bloomco.com as the external name for their internet presence. In order to protect the internal network and keep administration costs to a minimum, which of the following options should Leon consider using? (Select all that apply) bloomco.com ad.bloomco.com bloomco.net bloomco.lcl
9.	Sally is designing the WINS replication topology for her company. Seven offices have been identified as locations for WINS servers and all of the servers need to have records replicated to them so that the clients can find the resources they need. She has identified the Austin location as the hub for the replication topology and wants to make sure that the WINS service is available at all times. What can she do to increase the reliability of the WINS server? Increase the memory on the server. Put the WINS service on clustered hardware. Put the WINS service on domain controllers. Increase the number of processors.
10.	Tom is concerned that an attacker may be able to discover the addresses of servers on his network by using zone transfers. To alleviate his fears, what should be included within the DNS design? (Select all that apply.) Allow zone transfers only to systems identified by their IP address within the SOA record. Do not allow zone transfers to DNS servers within the perimeter network. Allow zone transfers to all servers. Use Active Directory-integrated zones within the perimeter network.

Answers

1.	C. The high-level DNS security policy, as defined by Microsoft, states that zone transfers should only be sent to other DNS servers that are configured through their IP address. The low-level DNS security policy allows zone transfers to any other DNS server whereas the mid-level DNS security policy allows zone transfers to any DNS server defined on the Name Servers tab of the SOA record. The secure-level policy does not really exist.
2.	B. Pull replication is configured to wait for a specified amount of time before requesting changes within the partner s database.
3.	B, C. Stub zones and delegations are methods for identifying DNS servers that are authoritative for a specific zone if the zone in question is not located on the current DNS server.
4.	D. A stub zone is responsible for redirecting clients to a name server that is authoritative for the zone they are querying. When a stub zone is created, it will copy the SOA record as well as the NS and A records of the name servers for the zone for which it is configured. The records will be refreshed based upon the time-to-live of the SOA record.
5.	A. DHCP clients can be configured to receive the IP address of the WINS server along with the node type, or resolution method, from the DHCP server.
6.	A, B, C, D. You will need to make sure you take the four attack types into account when designing the DNS infrastructure. Base your security requirements for each DNS server upon the attacks that are most likely to occur against that server.
7.	D. From the available options, only Windows Server 2003 will support Active Directory “ integrated zones. Of the other options, both of the UNIX BIND systems will support Active Directory, but only on primary and secondary zone types. Windows NT 4 DNS servers will not support Active Directory.
8.	B, C, D. By using names that are not the same as the Internet presence, the internal network is then separated from the internet presence, yet the administration is simplified since you can create delegation records, stub zones, or forwarding to allow internal users to gain access to external resources.
9.	B. The WINS service is cluster-aware and the only fault-tolerant option listed is the clustering solution.
10.	A, B. If you select to allow zone transfers to DNS servers that are identified by their IP address within the properties of the SOA record, you will only transfer zone data to those servers and not to all name servers within your network. You should not include servers within the perimeter if at all possible so that internal records are not hosted on a DNS server within the perimeter. You should not allow zone transfers to all DNS servers because that is an open door for an attacker to request and receive zone transfers. Active Directory “integrated zones are more secure because you host the zones within Active Directory instead of within a text file on the server. However if you place a server that has an Active Directory “integrated zone within the perimeter, you are placing a domain controller within the perimeter that will then be accessible to attackers who access your perimeter. Also, Active Directory “integrated zones need to have zone transfers configured just like primary zones since they allow the zone data to be replicated to secondary zones.