StudyByteLearn
← AZ-802: Administering Windows Server
AZ-802 · Networking · Networking | Implement on-premises and hybrid name resolution · Security · Security | Secure Windows Server operating system

Practice question 484 of 506 · hard

A security requirement asks Windows clients to reject unvalidated responses for a signed internal DNS namespace. Another requirement asks for confidentiality of traffic between two Windows servers. Which statement correctly separates the controls?

Choose the single best answer.

  1. A.Deploy a trust anchor and assume it automatically creates IPsec security associations for application traffic
  2. B.Sign the DNS zone and assume DNSSEC encrypts all application traffic between the servers
  3. C.Use DNSSEC validation policy for the signed namespace; use a suitable encrypted transport such as configured IPsec for server-traffic confidentiality
  4. D.Add an outbound firewall allow rule and assume it validates every DNS signature
Show the answer and explanation

✓ Correct answer

  • Use DNSSEC validation policy for the signed namespace; use a suitable encrypted transport such as configured IPsec for server-traffic confidentiality

DNSSEC validates DNS data authenticity and integrity when the chain and policy are correctly configured. It does not encrypt application traffic. IPsec encryption is a separate traffic control; an ordinary firewall allow rule does not validate DNSSEC signatures, and a DNS trust anchor does not create IPsec associations.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently written and not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product support and exam scope can change; a practice percentage is not a Microsoft exam scaled score.