CISSP Communication and Network Security Practice Question
An organization is implementing DNSSEC to protect its DNS infrastructure. Which of the following best describes the primary security benefit of DNSSEC?
⚠ Common exam trap
It's easy for candidates to confuse DNSSEC's authentication and integrity features with encryption or anonymity, mistakenly thinking it secures DNS by hiding data, when in fact it only signs data and leaves it readable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authentication of DNS data origin and integrity
DNSSEC (Domain Name System Security Extensions) provides origin authentication and data integrity verification for DNS responses through digital signatures. It uses public-key cryptography to sign DNS resource record sets (RRSIG records), allowing resolvers to verify that the data has not been modified in transit and originates from the authoritative source. This prevents attacks such as DNS cache poisoning and man-in-the-middle spoofing, but does not provide confidentiality or availability protections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Authentication of DNS data origin and integrity
Why this is correct
DNSSEC primarily establishes cryptographic trust in DNS data by using digital signatures to verify the origin of resource records and ensure their integrity. This process involves a chain of trust from the root zone down to individual domains, where DNSKEY and RRSIG records authenticate that the data originated from the legitimate zone owner and has not been altered during transit. This protection guards against cache poisoning and other forms of DNS data manipulation.
- ✗
Prevention of DDoS attacks on DNS servers
Why it's wrong here
DNSSEC is designed to validate the authenticity and integrity of DNS responses, not to mitigate network-level attacks. While it adds cryptographic overhead to DNS operations, it does not possess mechanisms to detect, filter, or absorb the high volume of malicious traffic characteristic of Distributed Denial of Service (DDoS) attacks. Such attacks overwhelm DNS servers with legitimate or spoofed queries, a problem DNSSEC does not address.
- ✗
Anonymization of DNS queries
Why it's wrong here
DNSSEC does not provide any functionality for anonymizing DNS queries or the clients making them. Its core purpose is to secure the integrity and authenticity of DNS data, not to obscure the source IP address of a querying client or the content of the query itself from network observers. Anonymization requires separate privacy-enhancing technologies, such as DNS over HTTPS (DoH) or DNS over TLS (DoT) with a trusted, privacy-focused resolver.
- ✗
Encryption of DNS queries and responses
Why it's wrong here
DNSSEC explicitly focuses on providing authentication and integrity for DNS data through digital signatures, but it does not encrypt DNS queries or responses. This means that while the authenticity of the data can be verified, the content of the DNS messages remains unencrypted and visible to anyone monitoring network traffic. To achieve encryption for DNS communications, separate protocols like DNS over TLS (DoT) or DNS over HTTPS (DoH) must be implemented.
Visual reference
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.