Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

LPIC 2 Exam 2 > DNS > Flashcards

DNS Flashcards

Understand DNS and how to configure it on Linux

1
Q

What is name resolution

A

The process of translating names to IP address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

At the top of the domain structure is the root domain (or “null”) This is typically written in documentation using which two notations

A

either ‘’ (that’s two single quotes) or

a single dot (.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a TLD?

A 
A top level domain, the level immediately below the root domain.  Examples of TLD's are 
.com
.co.uk
.org
etc.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a first-level domain?

A

that is the part of the domain name that preceedes the TLD. For example in
mydomain.com
“mydomain” is the first level domain.

A FQDN is usually made up of:
hostname.first-level-domain.TLD

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a FQDN?

A

A fully qualified domain name, consists of hostname, domain name and top-level domain.

A FQDN is usually made up of:
hostname.first-level-domain.TLD

Technically, it should end with a period therefore:

forums. opensuse.org should be written as
forums. opensuse.org.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How many designated DNS managers manage to DNS root zone?

A

13

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is an authoritative data file?

A

It’s either a zone file or zone database. A zone define what the domain server has authority over.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a resolver?

A

a program or routine that forms a dns query

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a Primary (Master) DNS Server?

A

A dns server that is considered authoritative as it has authority over one or more domains. The information it holds is known as authoritative information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a secondary (Slave) DNS Server

A

a dns server that is optional (but recommended for all but the smallest of implementations). It is used to support the primary server and take some of the burden.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a caching DNS Server?

A

a dns server that receives information from an authoritative dns erver and caches the results to improve performance. Often used by ISPs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a Forwarding DNS server, how does it differ from a caching dns server?

A

Like a caching dns server, this doesn’t have authoritative domain data but caches requests for performance. In addition, if it doesn’t have the answer for a dns query, it will forward the request to another dns server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a hybrid dns server?

A

a dns server that performs more than one role, for example a secondary slave server that is also a caching server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a stealth dns server?

A

a dns server that is not queried directly or is hidden behind a firewall. Stealth servers are often also hybrid dns servers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a recursive Name Server?

A

a dns server that will answer queries from local cache. If the answer is not cached, the recursive server will start the process of resolving the query.

First by querying a root server for a dns server for the TLD.
Then querying the TLD server for a dns server for the first-level domain.
Then querying the zone server for the host IP.

So a single DNS request can spawn a number of DNS requests by the recursive dns server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

BIND is popular name server on Linux, what does BIND stand for?

A

Berkeley Internet Name Domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Apart from BIND, the LPIC exam requires awareness for 4 other dns alternatives - what are they?

A

djddns - collection of dns apps, including tinydns
dnsmasq - lightweight dns and DHCP server
pdnsd - dns utility, not a full dns server
PowerDNS - full dns

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

what is bindutils

A

package of dns tools useful for testing and troubleshooting dns

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What packages for BIND would you on an RPM distro like Centos

A

yum install bind bind-utils

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What packages for BIND would you on an deb distro like Ubuntu

A

apt-get install bind9 bind9utils

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Where is the bind documentation likely to be?

A

/usr/share/doc/bind9

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Where are the config files likely to be in

a) Centos and
b) Ubuntu?

A

a) /etc/named.conf

b) /etc/bind/named.conf or /etc/bind9/named.conf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Here is an example options section of a named.conf file
options {
listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory “/var/named”;
dump-file “/var/named/data/cache_dump.db”;
statistics-file “/var/named/data/named_stats.txt”;
memstatistics-file “/var/named/data/named_mem_stats.txt”;
allow-query { localhost; };

    recursion yes;

    dnssec-enable yes;
    dnssec-validation yes;
        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";
    managed-keys-directory "/var/named/dynamic";

    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key"; };

Which interfaces is this server listening on?
Who is allowed to query the server?
Is the server caching queries?

A

The server is only listening on it’s local loopback network address (listen-on directive)

The server only allows queries from itself (allow-query directive)

The server is caching (Recursion yes; directive)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

This is a snippet from named.conf - what is it and what does it do?

zone “.” IN {
type hint;
file “named.ca”;
};

A

This defines the root zone. The file named.ca contains the root server addresses. This allows our dns server to start revolving names for queries that are not cached.

This directive is often called “hint for root level servers”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What does the include directive do in named.conf?
Allows you to include separate files in the configuration so, the config can be split into multiple files to ease admin. for example, bind9 on Ubuntu has a short named.conf file by default: ``` cat named.conf // This is the primary configuration file for the BIND DNS server named. // // Please read /usr/share/doc/bind9/README.Debian.gz for information on the // structure of BIND configuration files in Debian, *BEFORE* you customize // this configuration file. // // If you are just adding zones, please do that in /etc/bind/named.conf.local ``` include "/etc/bind/named.conf.options"; include "/etc/bind/named.conf.local"; include "/etc/bind/named.conf.default-zones";
26
Which utility can be used to check the syntax of named.conf after making amendments?
named-checkconf
27
Where are the zone files likely to be in a) Centos and b) Ubuntu?
a) /var/named/ | b) /etc/bind or /etc/bind9
28
To obtain the benefits of a caching server - it should be setup physically close the the network it is serving. How would you use an access control list (acl) to setup a caching dns server?
``` acl trustednet { 192.168.51.0/24; localhost; localnets; }; ``` allow-query { trutednet; }; listen-on port 53 { trustednet; }; recursion yes;
29
How would you test your local bind server with nslookup?
nslookup www.brainscape.com 192.168.51.2
30
How would you test your local bind server with dig?
dig www.brainscape.com @192.168.51.2 or dig +short +identify www.brainscape.com @192.168.51.2
31
To configure other linux systems to use your new dns server on older distros you would edit resolve.conf. However, many distros now overwrite that file on boot. To make the change permanent, which files would you edit on recent Centos and Ubuntu distros?
On Centos: /etc/sysconfig/network-scripts/[interface-name] change or add entry for DNS1 or DNS2 e.g. DNS1 = 192.168.51.2 On Ubuntu: /etc/network/interfaces add/amend entry for dns-nameservers e.g dns-nameservers 192.168.51.2 192.168.0.1
32
Using rndc, how do you stop, start and restart bind?
stop: rndc stop restart: rndc restart start: can't be done with rndc currently
33
Using ststemctl, how do you stop, start and restart bind?
systemctl start named (or bind) systemctl reload named systemctl stop named
34
How would you stop bind using signal interrupt or signal hangup?
kill -s SIGHUP $(cat /run/named/named.pid) kill -s SIGINT $(cat /run/named/named.pid) Although.... best method for controlling bind is now rndc
35
How would you reload binds config files using rndc?
rndc reload
36
How would you reload a single zone using rndc?
rndc reload [zonename]
37
How would you stop bing saving any pending updates using rndc?
rndc stop
38
How would you stop bing without saving any pending updates using rndc?
rndc halt
39
How would you flush binds cache using rndc?
rndc flush
40
How would you flush binds cache for a single domain using rndc?
rndc flushname [domainname]
41
How would you check the status of bind using rndc?
rndc status
42
What does a bind logging channel do?
Control WHERE messages are logged
43
What does a bind logging category directive do?
Controls WHAT types of messages are logged
44
What are the 4pre-defined logging channels in bind?
default_debug (writes to named.run) default_syslog (writes to syslog or rsyslog) default_stderr (writes to stderr) null (Doesn't log)
45
Bind logging severity levels go from dynamic to critical what's in between?
``` dynamic debug [#] (level number 0, 1, 2, 3..) info notice warning error critical ```
46
Who are the current maintainers of bind?
ISC www.isc.org
47
What is a dns zone?
A zone defines what a nameserver has authority over. It includes maintaining the zone's authoritative data files (zone files or zone databases)
48
You see this in named.conf, what is it? zone "localhost" { type master; file "/etc/bind/db.local"; };
This is the zone directive for local host. The authoritative data is in /etc/bind/db.local
49
There are a number of zone types, including master and slave can you name another 6?
Master slave ``` forward hint redirect stub static-stub delegation-only ```
50
This is an example slave zone directive. Explain what each part means ``` zone "secondary.example.com" IN { type slave; file "/etc/secondary.example.com"; masters { 192.168.0.104; }; allow-notify {192.168.0.104; }; }; ```
First lines defines INternet zone secondary.example.com type slave = this is a secondary, slave nameserver for this zone. file = local copy of the zone data masters = list of the master authoritative domains for the zone allow-notify = only allow list to update the zone
51
Under what circumstances do zone transfers occur?
Secondary (slave) server is started or restarted Zone data refresh time has expired The master has sent slave zone change notification A manual request via rndc
52
Authoritative zone data comes in two forms, DIRECTIVE and RESOURCE RECORDS. 3 common directives are $ORIGIN, $INCLUDE, $TTL what are they used for?
$ORIGIN - sets the domain name for the zone file $INCLUDE - includes the contents of external files $TTL - Sets the default time to live
53
A DNS resource record provides the zones authoritative name resolution info, what is the function of a "A" record type?
a host address record for ipv4
54
A DNS resource record provides the zones authoritative name resolution info, what is the function of a "AAAA" record type?
a host address record for ipv6
55
A DNS resource record provides the zones authoritative name resolution info, what is the function of a "CNAME" record type?
A canonical name record maps an alias to a host name
56
A DNS resource record provides the zones authoritative name resolution info, what is the function of a "MX" record type?
A mail exchange record declares a preference value followed by mail hostname(s)
57
A DNS resource record provides the zones authoritative name resolution info, what is the function of a "NS" record type?
A name server record - specifies the zone's authoritative name server.
58
A DNS resource record provides the zones authoritative name resolution info, what is the function of a "PTR" record type?
A pointer record points to another domain namespace location and is typically used in reverse lookups
59
A DNS resource record provides the zones authoritative name resolution info, what is the function of a "SOA" record type?
a Start of Authority record identifies the authority for a zone and includes the zones authoritative data. ONLY one SOA record for a zone should be created.
60
A DNS resource record provides the zones authoritative name resolution info, what is the function of a "TXT" record type?
A text record holds free-form text enclosed in quotation marks, which can serve various purposes.
61
What zone naming convention is often used in reverse zones?
The first 3 octets of the ipv4 address reversed, followed by the text in-addr.arpa For example for the IP address 192.168.20.20 20.168.192.in-addr.arpa
62
What zone name would you use for the reverse lookup of LPIC2.example.com at iP address 192.168.10.10
10.168.192.in-addr.arpa
63
What utility can you use to check the syntax of your named config files prior to starting or restarting the named service?
named-checkzone by default will check named.conf or use named-checkzoe [filename] to check another file
64
What is delegating a zone?
A zones authoritative data is put on another name server(s) and authorty is given to that name server.
65
What is a "glue" record
a glue record provides a pointer to a new DNS server where that dns server has been delegated authority. It looks something like this: @ IN NS LPIC2.example.com. LPIC2 IN A 192.168.64.120
66
What tools are available to troublshoot bind?
host dig nslookup rndc
67
How would you use dig to query a domain using a domain name server that isn't listed in your resolv.conf?
dig @[nameserver] [domain] e.g. dig @8.8.8.8 cnn.com
68
What does the dig result NXDOMAIN indicate?
The name server believes the domain name doesn't exist
69
How would you do a reverse lookup with dig on the IP address 192.168.10.10?
dig -x 192.168.10.10
70
How would you use dig to check the mx records for a domain?
dig mx example.com or dig mx +short example.com
71
How would you use the host utility to check mx records in a domain?
host -t mx example.com
72
When trouble shooting bind, there is a utility to convert binary zone files back to text and text files to binary What is is called?
named-compilezone
73
How would you use nslookup to find the authoritative IP address for the domain example.com?
nslookup -query=ns example.com
74
What happens if you enter the command nslookup on its own (i.e. without parameters)?
You will be in nslookup's interactive mode
75
Named (bind) has two tools to check local config files. What are they?
named-checkconfig named-checkzone
76
For security it may be wise o hide the version number on public facing dns servers. Which directive in the config will achieve that?
the version directive e.g. version "null"
77
For security, ou may want to setup different views of the DNS server for internal and external clients. What types of directive might you want to change for external clients?
``` Hide the bind version number (version directive) disable recursion (recurion no) disable queries from external (allow-query none) disallow access to the DNS cache (allow-query-cache none) ```
78
What is a split DNS configuration? (also called dual horizon or split horizon)
is one or more DNS servers serving different DNS purposes. This can be accomplished using views fo internal and external clients or by using separate servers - one private and one public.
79
Is it a good idea to run bind along with other services on your public server?
No. Generally it is advised torun only bind to reduce the potential "attack surface" on the server. AND - run bind as a non-root user
80
Describe the process of chrooting bind using the bind-chroot package available on some distros.
Install bind and bindutils. Configure and test the bind configuration stop the bind service install the bind-chroot package do an rpm -ql bind-chroot and look for the name and location of the shell script. Run the shell script Change the /etc/default/bind file, and append -t /chroot/path While you are these, make sure named is running as a non-root user (-u named or the like) start bind-chroot make sure bind is running in chroot: ps aux |grep bind
81
Describe th process of manually setting up bind in a chroot environment.
Create a new directory, e.g. /chroot/named create new subdirectories under the new directory: etc/bind home/named proc var/run var/log copy files into these directories copy bind config files into chroot etc copy zone configs and database files into chroot modify bind user account so home directory now points to chroot change ownership and permission of files and directories change bind start options to start as bind or named user and in /chrot/named directory
82
Does DNSSEC encrypt dns queries between the client and the server?
No! it uses asymmetric encryption to provide digital signatures. That is, it verifies the server, but doesn't encrypt traffic.
83
What is DNSSEC?
its a bind security extension
84
A couple of important DNSSEC resource record types are DNSKEY and RRSIG. What ar these record types used for?
DNSKEY - Public Key | RRSIG- Digital Signature
85
What is a DNSSEC validating resolver?
A dns resolver that executes DSSEC validation
86
What is a DNSSEC trust anchor?
a DNSKEY record on a validating resolver
87
What is a DNSSEC chain of trust?
Zones signed with higher/lower zones
88
What is a DNSSEC Zone signing Key (ZSK)?
The encryption key used to sign zone records
89
What is a DNSSEC Key Signing Key (KSK)?
The key used to sign the zones ZSK
90
What is DNSSEC Data Validation?
Data validation occurs on validating resolver when it reraces the chain of trust & verifies answers authenticiity.
91
What is a DNSSEC SERFAIL?
A validating resolver response when the DNSSEC data validation fails.
92
5 Key named.conf settings for DNSSEC?
``` dnssec-enable yes; dnssec-validation yes; trusted-keys managed-keys bindkeys-file ```
93
What is DNSSEC Lookaside validation?
because of the chain of trust DNSSEC validation will not work if zones higher in the chain are not signed. DLV allows the dns server to provide a trust anchor even if higher zones are unsigned. This should be used as a temp measure until all the servers in the chain are signed.
94
How can you use dig to check for dnssec on a name server?
dig +dnssec 127.0.0.1
95
What utility can we use to generate dnssec keys?
dnssec-keygen This utility creates a zone.private file and a zone.key file
96
What does TSIG stand for and what does it do?
TSIG stands for Transaction Signature, it signs a DNS message with a digital signature providing point-to-point authentication.
97
Why might you consider using NTP when using TSIG?
TSIG uses a timestamp in the symmetric encryption process so it is important clients and servers keep the same time. Using the timestamp helps avoid the use of replay attacks on DNS servers.
98
What does DANE stand for?
DNS-based Authentication of named entities.
99
What does DANE do?
DANE associates certificate or public key with a servers domain name using a DNS query. This query is secured via DNSSEC. This association is called certificate association which is stored in a DNS record called a TLSA record.
100
What is a TLSA record?
A DNS record used by DANE to associate a certificate or pblic key with a server.

LPIC 2 Exam 2 (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions