The correct answer is that NSEC3 provides authenticated denial of existence while making zone enumeration more difficult than NSEC. This is achieved through the use of hashed owner names in NSEC3 records, which prevent an attacker from walking the zone’s sorted list of names as they could with plain NSEC. Additionally, the NSEC3 specification includes an opt-out flag that allows insecure delegations—zones not signed with DNSSEC—to exist without requiring corresponding NSEC3 records, reducing zone size and improving performance. On the LPIC-2 exam, this concept tests your understanding of DNSSEC operational trade-offs, often appearing in scenario-based questions about BIND 9 configuration. A common trap is confusing NSEC3’s opt-out with simple hashing; remember that opt-out specifically skips creating records for unsigned delegations, not just obscuring names. Memory tip: “Opt-out omits unsigned outs” to recall that opt-out leaves out NSEC3 records for delegations lacking DNSSEC signatures.
LPIC-2 DNS, Web and Mail Services Practice Question
This LPIC-2 practice question tests your understanding of dns, web and mail services. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An administrator is configuring a BIND 9 DNS server to support DNSSEC for the zone 'example.com'. The zone is signed using the NSEC3 algorithm. Which TWO statements are correct regarding the configuration and operation of NSEC3?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NSEC3 record uses the 'opt-out' flag to allow insecure delegations to exist without being covered by NSEC3 records.
Option B is correct because the NSEC3 specification (RFC 5155) includes an 'opt-out' flag that allows insecure delegations (i.e., delegations that are not signed with DNSSEC) to exist in a zone without requiring corresponding NSEC3 records. This prevents the zone from being forced to cover every possible owner name, reducing the size of the signed zone and improving performance when many unsigned delegations are present.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
NSEC3 records are stored in the zone in plain text order to allow efficient denial of existence.
Why it's wrong here
NSEC3 records are stored in hash order, not plain text order.
✓
The NSEC3 record uses the 'opt-out' flag to allow insecure delegations to exist without being covered by NSEC3 records.
Why this is correct
Opt-out allows delegations that are not signed to be skipped.
Related concept
Read the scenario before looking for a memorised answer.
✗
The NSEC3 record type is NXT and is used to provide authenticated denial of existence.
Why it's wrong here
NXT is the DNSSEC record for NSEC, not NSEC3.
✗
NSEC3 uses SHA-256 as the default hash algorithm.
Why it's wrong here
NSEC3 uses SHA-1 by default.
✓
NSEC3 provides authenticated denial of existence while making zone enumeration more difficult than NSEC.
Why this is correct
NSEC3 hashes record names to prevent easy enumeration.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse NSEC3 with NSEC, assuming NSEC3 also uses plain-text ordering or that it always covers all names, when in fact NSEC3 uses hashed ordering and the opt-out flag allows skipping unsigned delegations.
Detailed technical explanation
How to think about this question
Under the hood, NSEC3 hashes owner names using an iterative hash algorithm (default SHA-1) and sorts the resulting hashes in a ring to provide authenticated denial of existence. The 'opt-out' flag (bit 7 of the NSEC3 flags field) is particularly useful in large zones like .com, where many delegations are unsigned; without opt-out, every delegation would require an NSEC3 record, dramatically increasing zone size and signing overhead. Real-world deployments often combine NSEC3 with a low iteration count to balance security against computational cost.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the LPIC-2 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
DNS, Web and Mail Services — This question tests DNS, Web and Mail Services — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The NSEC3 record uses the 'opt-out' flag to allow insecure delegations to exist without being covered by NSEC3 records. — Option B is correct because the NSEC3 specification (RFC 5155) includes an 'opt-out' flag that allows insecure delegations (i.e., delegations that are not signed with DNSSEC) to exist in a zone without requiring corresponding NSEC3 records. This prevents the zone from being forced to cover every possible owner name, reducing the size of the signed zone and improving performance when many unsigned delegations are present.
What should I do if I get this LPIC-2 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.