SSCP Network and Communications Security Practice Question
A financial services firm needs to detect unauthorized changes to its public DNS records that could redirect customers to a phishing site. The security team wants a control that validates DNS responses cryptographically so that a resolver can verify the data originated from the authoritative zone. Which technology should they implement?
⚠ Common exam trap
Candidates often confuse encryption of DNS traffic with authentication of DNS data, so a privacy feature like DoH is mistaken for an integrity control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNSSEC (Domain Name System Security Extensions)
DNSSEC is the only listed control that signs DNS records and lets a validating resolver verify their origin and integrity through a chain of trust. Encryption options such as DoH protect the query path but not the data's authenticity, while sinkholing and split-horizon DNS address different problems. For detecting tampering with public records, DNSSEC provides the required cryptographic assurance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS over HTTPS (DoH)
Why it's wrong here
DoH encrypts DNS queries between the client and the resolver, which protects privacy on the wire but does not cryptographically validate that the answer itself is authentic. A malicious or compromised resolver could still return forged records inside the encrypted tunnel. DoH does not provide origin authentication for DNS data, so it does not meet the stated requirement.
- ✓
DNSSEC (Domain Name System Security Extensions)
Why this is correct
DNSSEC adds digital signatures to DNS records so a validating resolver can confirm that the data came from the authoritative zone and was not altered in transit. It directly addresses cache poisoning and record tampering by using a chain of trust from the root down to the zone. This matches the requirement for cryptographic validation of DNS responses.
- ✗
DNS sinkholing
Why it's wrong here
Sinkholing redirects known malicious domains to a controlled address, which can block access to phishing infrastructure but does not validate the authenticity of legitimate DNS records. It is a reactive blocklist technique and would not detect an attacker altering the firm's own public records. It also does not provide cryptographic proof of origin.
- ✗
Split-horizon DNS
Why it's wrong here
Split-horizon DNS serves different answers to internal and external clients, which is useful for separating internal names from public ones but provides no cryptographic validation. An attacker who compromises an authoritative server or a cache could still alter records. This design choice does not prevent or detect unauthorized changes to public DNS data.
Visual reference
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.