CEH Practice Question: Malware, Social Engineering and Network Attacks
An organization wants to protect against DNS spoofing attacks. Which security measure is MOST effective in preventing an attacker from poisoning DNS cache entries?
⚠ Common exam trap
A common misconception is that disabling DNS recursion or using a firewall is sufficient to prevent cache poisoning, but the only cryptographic solution that ensures data origin authentication and integrity is DNSSEC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement DNSSEC
DNSSEC (Domain Name System Security Extensions) is the most effective measure against DNS spoofing because it cryptographically signs DNS data using public-key cryptography, allowing resolvers to verify the authenticity and integrity of responses. This prevents an attacker from injecting forged DNS records into the cache, as any tampered response would fail signature validation per RFC 4033–4035.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use IPsec
Why it's wrong here
IPsec operates at the network layer (Layer 3) to provide secure communication channels through authentication and encryption of IP packets. While it can protect the transport of DNS queries and responses between a client and a specific DNS server, it does not validate the authenticity or integrity of the DNS data itself, nor does it verify the origin of the DNS records from the authoritative source. Therefore, it cannot prevent an attacker from injecting forged DNS records into a resolver's cache or directly to a client if the channel itself is not compromised.
- ✓
Implement DNSSEC
Why this is correct
DNSSEC (Domain Name System Security Extensions) directly addresses DNS spoofing by adding cryptographic digital signatures to DNS records. These signatures allow DNS resolvers to cryptographically verify the authenticity and integrity of DNS responses, ensuring that the data originated from the correct authoritative server and has not been tampered with in transit. This validation process establishes a chain of trust, making it possible to detect and reject forged or manipulated DNS information, thereby preventing spoofing attacks.
- ✗
Use a firewall
Why it's wrong here
A firewall primarily functions by filtering network traffic based on predefined rules such as IP addresses, ports, and protocols, operating at various layers of the OSI model. While effective for blocking unauthorized access or specific types of malicious traffic, a firewall lacks the intrinsic capability to cryptographically validate the authenticity or integrity of the DNS payload itself. It cannot discern between a legitimate DNS response and a spoofed one that adheres to expected network parameters, making it ineffective against data-level spoofing.
- ✗
Disable DNS recursion
Why it's wrong here
Disabling DNS recursion on an authoritative name server prevents it from performing recursive queries on behalf of clients for domains it does not host. This measure can mitigate certain types of cache poisoning attacks by limiting the server's exposure as an open recursive resolver. However, it does not provide comprehensive protection against DNS spoofing, as it doesn't validate the authenticity of DNS responses received by clients or other recursive resolvers, nor does it prevent direct attacks against client-side DNS resolution.
Visual reference
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.