CISSP Communication and Network Security Practice Question
A network administrator is configuring DNSSEC to protect against DNS spoofing. Which record type is used to provide cryptographic verification of DNS data origins?
⚠ Common exam trap
Candidates often confuse the role of DNSKEY (the key) with RRSIG (the signature), mistakenly thinking the public key itself provides verification, when in fact the signature record (RRSIG) is what cryptographically binds the data to the zone.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RRSIG
RRSIG (Resource Record Signature) is the DNSSEC record type that contains the cryptographic signature for a DNS record set. It provides data origin authentication and integrity verification by allowing resolvers to validate that the DNS data came from the authoritative source and was not modified in transit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
RRSIG
Why this is correct
The RRSIG (Resource Record Signature) record contains the cryptographic digital signature for a specific DNS resource record set (RRset). This signature is generated using a private key associated with the zone and allows DNS resolvers to cryptographically verify the authenticity and integrity of the corresponding RRset. By checking the RRSIG, resolvers can confirm that the data originated from the authoritative server and has not been tampered with in transit, thus directly protecting against modification.
- ✗
DS
Why it's wrong here
The DS (Delegation Signer) record is crucial for establishing the chain of trust in DNSSEC between a parent zone and its child zone. It contains a hash of a child zone's Key Signing Key (KSK) and is published in the parent zone. This record does not directly sign individual data records within the child zone but instead serves as a pointer, allowing resolvers to locate and validate the public keys used by the child zone to sign its own data.
- ✗
DNSKEY
Why it's wrong here
The DNSKEY record holds the public key components (either a Key Signing Key or a Zone Signing Key) that are essential for DNSSEC validation. These public keys are used by validating resolvers to verify the RRSIG records associated with DNS data. While DNSKEYs are fundamental to the cryptographic process, they themselves are not the digital signatures that protect the integrity of specific resource records; rather, they are the cryptographic instruments used to generate and verify those signatures.
- ✗
NSEC
Why it's wrong here
The NSEC (Next Secure) record is a critical component of DNSSEC designed to provide authenticated denial of existence for DNS records. When a query for a non-existent record is made, the authoritative server returns an NSEC record that cryptographically proves that the requested name does not exist between two existing, signed names in the zone. Its purpose is to prevent cache poisoning attacks related to non-existent records and to prevent zone enumeration, not to sign or protect the integrity of existing data records.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.