CISSP Communication and Network Security Practice Question
A company deploys DNSSEC to protect its DNS infrastructure. Which cryptographic operation does DNSSEC primarily use to ensure the authenticity and integrity of DNS data?
⚠ Common exam trap
It's easy for candidates to confuse DNSSEC's use of digital signatures for data origin authentication with encryption or transport-layer security, leading candidates to incorrectly select TLS or symmetric encryption options.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Digital signatures of DNS records
DNSSEC primarily uses digital signatures to ensure the authenticity and integrity of DNS data. Each DNS zone is signed with a private key, and resolvers verify the signatures using the corresponding public key, which is published as a DNSKEY record. This process allows the resolver to cryptographically confirm that the data has not been modified in transit and originates from the authoritative source.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hashing of DNS responses without keys
Why it's wrong here
Hashing alone provides integrity checking, ensuring data has not been tampered with in transit. However, without a cryptographic key or digital signature, hashing does not verify the *origin* of the DNS response. DNSSEC's core function is to authenticate that the DNS data originated from the authoritative source, which simple unkeyed hashing cannot achieve, leaving responses vulnerable to spoofing.
- ✓
Digital signatures of DNS records
Why this is correct
DNSSEC fundamentally relies on digital signatures to provide data origin authentication and integrity for DNS records. Authoritative DNS servers sign their zone data using a private key, creating RRSIG (Resource Record Signature) records. Resolvers then use the corresponding public key, chained through the DNSSEC trust anchor, to verify these signatures, confirming that the DNS data is authentic and has not been altered since it was signed by the zone owner.
- ✗
Transport Layer Security for DNS
Why it's wrong here
Transport Layer Security (TLS), often used in DNS over TLS (DoT), secures the communication channel between a DNS client and a recursive resolver. While TLS encrypts and authenticates the *connection*, it does not provide end-to-end data origin authentication for the DNS records themselves, which is DNSSEC's specific role. DNSSEC operates at the DNS data layer, verifying the authenticity of the records within the zone, independent of the transport layer security.
- ✗
Symmetric encryption of DNS queries
Why it's wrong here
DNSSEC's primary objective is to authenticate the origin and ensure the integrity of DNS data, not to provide confidentiality for DNS queries. Symmetric encryption would encrypt the content of DNS queries, hiding them from eavesdroppers, but this is outside the scope of DNSSEC's design. DNSSEC uses asymmetric cryptography for digital signatures to validate data, rather than symmetric encryption to obscure query traffic, which is a function typically addressed by protocols like DNS over TLS.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.