GCIH: GIAC Certified Incident HandlerDemo

By GIAC · Question Mode

QuestionQ379

Scanning and Mapping

After the recent acquisition of a new business, your manager asks you to examine its DNS service and report on its status. He is concerned because the organization has only one DNS server, and it is exposed to the Internet. What actions and recommendations should be taken as an initial step?

  • A Review the logs of the acquired business' firewall for port 53 traffic. Add a firewall rule to block port 53 traffic.
  • B Ensure zone transfer requests from the acquired business' DNS server are disabled. Propose a plan to migrate the DNS service to your split-DNS infrastructure.
  • C Use the nslookup command to direct the aquired business' DNS server to transfer its records to your primary DNS server. Block all other traffic at the firewall.
  • D Remove the acquired business' DNS server from the network. Import its database entries into your secure infrastructure.
Explanation

Unrestricted DNS zone transfers can expose internal DNS zone information to any host that can reach the DNS server, so zone transfers should be disabled or restricted to explicitly authorized DNS servers. Moving the acquired organization’s single Internet-exposed DNS service into a split-DNS infrastructure separates internal and external DNS use and reduces both exposure and the single-server risk.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!