LPIC-2 DNS, Web and Mail Services Practice Question
An administrator is configuring a BIND 9 DNS server to support DNSSEC for the zone 'example.com'. The zone is signed using the NSEC3 algorithm. Which TWO statements are correct regarding the configuration and operation of NSEC3?
⚠ Common exam trap
Test-takers frequently confuse NSEC3 with NSEC, assuming NSEC3 also uses plain-text ordering or that it always covers all names, when in fact NSEC3 uses hashed ordering and the opt-out flag allows skipping unsigned delegations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NSEC3 record uses the 'opt-out' flag to allow insecure delegations to exist without being covered by NSEC3 records.
The NSEC3 specification (RFC 5155) includes an 'opt-out' flag that allows insecure delegations (i.e., delegations that are not signed with DNSSEC) to exist in a zone without requiring corresponding NSEC3 records. This prevents the zone from being forced to cover every possible owner name, reducing the size of the signed zone and improving performance when many unsigned delegations are present.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
NSEC3 records are stored in the zone in plain text order to allow efficient denial of existence.
Why it's wrong here
NSEC3 records are stored in hash order, not plain text order.
- ✓
The NSEC3 record uses the 'opt-out' flag to allow insecure delegations to exist without being covered by NSEC3 records.
Why this is correct
Opt-out allows delegations that are not signed to be skipped.
- ✗
The NSEC3 record type is NXT and is used to provide authenticated denial of existence.
Why it's wrong here
NXT is the DNSSEC record for NSEC, not NSEC3.
- ✗
NSEC3 uses SHA-256 as the default hash algorithm.
Why it's wrong here
NSEC3 uses SHA-1 by default.
- ✓
NSEC3 provides authenticated denial of existence while making zone enumeration more difficult than NSEC.
Why this is correct
NSEC3 hashes record names to prevent easy enumeration.
Visual reference
Go deeper
Related to this question
About these practice questions
This LPIC-2 question is part of Courseiva's 507-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.