3.3 DNS

Question 1

Explain DNS

Answer 1

A hierarchical naming system that resolves a hostname to an IP address.

Question 2

Explain DNS Record Types

Answer 2

A: IPv4 host
AAAA: IPv6 host
CNAME: Alias
SRV records: Finds services such as a domain controller
MX: Mail Server

Question 3

Explain SPF

Answer 3

Sender Policy Framework

This is a text (TXT) record used by DNS to prevent spam and confirm the email has come from the domain it appears to come from.

Question 4

Explain DMARC.

Answer 4

Domain-based Message Authentication, Reporting and conformance

This is another DNS text (TXT) that is used by Internet Service Providers (ISPs) to prevent malicious email, such as phishing or spear phishing attacks.

Question 5

Explain DNS Cache

Answer 5

Stores recently resolved DNS requests for later reuse, reducing calls to the DNS server.

Question 6

Explain Hosts File

Answer 6

This is a flat-file where name and IP pairs are stored on a client.
Often checked before request is sent to DNS server

Question 7

Explain DNS Server

Answer 7

This normally maintains only the hostnames for domains it is configured to serve.
server is said to be “authoritative” for those domains.

Question 8

Explain Root Server

Answer 8

DNS nameservers that operate in the root zone. They can also refer requests to the appropriate Top-Level Domain (TLD) server

Question 9

Explain DNSSEC

Answer 9

Prevents unauthorized access to DNS records on the server. Each DNS record is digitally signed, creating an RRSIG record to protect against attacks

Question 10

What is DNS Poisoning

Answer 10

When an attacker alters the domain-name-to-IP-address mappings in a DNS system to redirect traffic to a rogue system or perform DoS against a system.

Question 11

What is DNS Spoofing

Answer 11

Occurs when an attacker sends false replies to a requesting system, beating the real reply from the valid DNS server.

Question 12

What is DNS Hijacking

Answer 12

AKA DNS Redirection attack

Many ways to perform DNS Hijacking, the most common way we see is used by a captive portal such as a pay-for=use WiFi hotspot.

Question 13

What is a Homograph Attack

Answer 13

Leverages similarities in character sets to register phony international domain names (IDNs) that appear legitimate to the naked eye.

e.g Latin character “a” is replaced with the Cyrillic character “a” in example.com