Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CSCI 4130 - Intro to Cybersecurity > Domain Name System > Flashcards

Domain Name System Flashcards

1
Q

Define

Host Names

DNS

A

Mnemonic/easily memorable for humans

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Define

Domain Name System

DNS

A

Provides translation from host name to IP address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

DNS is what type of distributed database that leverages what?

DNS

A

A performance-critical distributed database that leverages caches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Why is DNS needed?

DNS

A

For SOP assumptions and web security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the hiearchy of name servers?

DNS

A

Root servers > Authoritative name servers > Local Name resolver

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Where are root servers?

DNS

A

Hardcoded into other servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are root servers for?

DNS

A

Top-level domains (TLD)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are authoritative name servers for?

DNS

A

Subdomains

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does local name resolvers do?

DNS

A

Caches name resolution results

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What does the local name resolver go to for non-cached names?

DNS

A

Authoritative name servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Describe

DNS Lookup

DNS

A
  1. Client requests information
  2. Local resolver fetches from Root DNS => TLD DNS server => Authoritative DNS sever
  3. Local resolver returns information to client
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Describe

Components of DNS Packet

DNS

A

Source/dest ports, length, checksum, query ID, questions/answers, authority, additional info

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

List DNS Resource Records

DNS

A
  • Address Mapping (A)
  • Canonical Name (CNAME)
  • Mail Exchanger (ME)
  • Name Server (NS)
  • Start of Authority (SOA)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Define

DNS Resource Record: Address Mapping (A)

DNS

A

Maps host to IP Address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Define

DNS Resource Record: Canonical Name (CNAME)

DNS

A

Maps host to alias

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Define

DNS Resource Record: Mail Exchanger (ME)

DNS

A

Directs email to a specific server

17
Q

Define

DNS Resource Record: Start of Authority (SOA)

DNS

A

Specifies core information (name server, email of domain admin)

18
Q

Define

DNS Caching

DNS

A

Holds the responses for repeated translations

19
Q

Describe

DNS Caching: Negative Queries

DNS

A

Non-existing host names

20
Q

Limitation of DNS Caching

DNS

A

Cache will periodically time out

21
Q

Who controls the DNS cache and what happens to it at every record?

DNS

A

DNS cache is controlled by data owner and it is passed with every record

22
Q

Define

Kamisky Blind Spoofing

DNS

A

Injecting forged replies with different IDs in hopes of matching victim’s queries

23
Q

Defenses against Kamisky Blind Spoofing

DNS

A
  • Usage of random source ports
  • Increased entorpy/load of DNS
24
Q

Components of DNS Query

DNS

A
  • Question includes query
  • ID
  • Answer section = resource record + IP addr of domain name + lifetime of cache to answer
  • Authority of host name servers behind the answers
  • Additional section = supplemental info
25
Q

When sent over UDP, DNS is unable to protect what?

DNS

A

CIA

26
Q

Two DNS threats

DNS

A

Malicious DNS server and eavesdropping

27
Q

Describe

DNS Threat: Malicious DNS Server

DNS

A

Fools the user to answer DNS queries on a fake DNS server to gain access to information

28
Q

Defenses against Malicious DNS Server

DNS

A

Client doesn’t accept record in the Additional Section if domain of user doesn’t match their request

29
Q

Describe

DNS Threat: Eavesdropping for off-path attackers

DNS

A

Blind spoofs and races against actual DNS server using Additional field

30
Q

What do off-path eavesdroppers need for an DNS eavesdropping attack?

DNS

A

The port (typically 53) and the ID

31
Q

How do off-path attackers obtain ID for DNS eavesdropping attack?

DNS

A

Trick the user into submitting a lookup query into the DNS

32
Q

Defense against Eavesdropping

DNS

A

Censorship

33
Q

Describe

DNS Security Extensions (DNSSEC)

DNS

A

Providing an origin of authentication and integrity through a chain of trust

34
Q

Describe

DNSSEC’s Chain of Trust

DNS

A

Each lookup level is signed with a DNS private key and vouched by public keys of the upper layers

35
Q

What is the order for the DNSSEC Chain of Trust?

DNS

A

DNS => DNSKEY => DS => …

36
Q

Where are the root public keys for the DNSSEC?

DNS

A

Hardwired into the servers

37
Q

Two types of DNSSEC Keys

DNS

A

Key-Signing Keys (KSK) and Zone-Signing Keys (ZSK)

38
Q

Define

Key-Signing Keys (KSK)

DNS

A

DNSKEY/public key zones

CSCI 4130 - Intro to Cybersecurity (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions