StudyByteLearn
← AZ-802: Administering Windows Server
AZ-802 · Networking · Networking | Implement on-premises and hybrid name resolution

Practice question 192 of 506 · hard

A Windows client receives RRSIG records with Resolve-DnsName -DnssecOk, but the team claims this alone proves enforced validation. What is the correct assessment?

Choose the single best answer.

  1. A.Requesting signatures is different from validating trust and enforcing effective NRPT requirements
  2. B.DnssecOk encrypts every DNS packet automatically
  3. C.Any received RRSIG is trusted even without a valid key chain
  4. D.nslookup automatically applies an equivalent cryptographic enforcement test
Show the answer and explanation

✓ Correct answer

  • Requesting signatures is different from validating trust and enforcing effective NRPT requirements

DnssecOk requests DNSSEC data; trust-chain validation and required policy must be checked. It does not encrypt traffic. An untrusted or invalid signature is not proof of authenticity, and nslookup is not an equivalent DNSSEC-aware enforcement test.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently written and not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product support and exam scope can change; a practice percentage is not a Microsoft exam scaled score.