CISSP Communication and Network Security Practice Question
An organization is implementing DNSSEC to protect against DNS spoofing attacks. Which of the following best describes the primary security function provided by DNSSEC?
⚠ Common exam trap
Many exam-takers confuse DNSSEC's authentication and integrity functions with encryption or anonymity, leading candidates to incorrectly select encryption (Option C) or anonymity (Option A) when DNSSEC explicitly does not provide confidentiality.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authenticating the origin and ensuring integrity of DNS responses
DNSSEC (Domain Name System Security Extensions) provides data origin authentication and data integrity for DNS responses using digital signatures based on public-key cryptography. It does not encrypt DNS data or provide anonymity; instead, it allows a resolver to verify that a DNS response has not been modified in transit and that it originates from the authoritative source. This directly counters DNS spoofing attacks by ensuring the response is authentic and untampered.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Providing anonymous DNS resolution
Why it's wrong here
DNSSEC's primary function is to provide cryptographic authentication of DNS data origin and integrity, not to obscure the identity of the querying client or the content of the query itself. It operates at the DNS protocol level to secure responses, leaving the client's IP address and the requested domain name visible to intermediate DNS resolvers and network observers. Therefore, it offers no inherent privacy or anonymity features for users making DNS requests.
- ✓
Authenticating the origin and ensuring integrity of DNS responses
Why this is correct
DNSSEC fundamentally addresses DNS spoofing and cache poisoning by employing digital signatures to cryptographically authenticate the origin of DNS data and ensure its integrity throughout the resolution process. It establishes a chain of trust from the root zone down to individual domain names, allowing resolvers to verify that the received DNS responses are authentic and have not been tampered with. This validation process relies on public-key cryptography to confirm that the data originates from the legitimate authoritative server.
- ✗
Encrypting DNS queries to prevent eavesdropping
Why it's wrong here
DNSSEC does not provide encryption for DNS queries or responses; its cryptographic mechanisms are solely focused on digital signing to ensure data authenticity and integrity. While DNSSEC prevents attackers from forging DNS records, the actual content of the DNS queries and responses remains unencrypted and can be observed by anyone monitoring network traffic. To achieve encryption and prevent eavesdropping, separate protocols like DNS over TLS (DoT) or DNS over HTTPS (DoH) must be implemented in conjunction with or instead of standard DNS.
- ✗
Blocking malicious DNS queries at the resolver
Why it's wrong here
DNSSEC is a validation mechanism that verifies the authenticity and integrity of DNS responses, rather than an active filtering or blocking system for malicious queries. It enables a validating resolver to detect if a DNS response has been tampered with or originates from an unauthorized source, but it does not proactively block queries based on reputation, content, or known threats. Blocking malicious queries is typically a function performed by firewalls, intrusion prevention systems, or specialized DNS filtering services that operate independently of DNSSEC's core validation role.
Visual reference
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.