CompTIA CASP+ Practice Test

What is a critical aspect when using TSIG for DNS zone transfers?

1. Unencrypted exchange of key values

2. Secure exchange of the key values

3. Use of multiple NTP sources

4. Public key infrastructure implementation

The correct answer is: Secure exchange of the key values

When using TSIG (Transaction Signature) for DNS zone transfers, a critical aspect is the secure exchange of key values. TSIG provides a method for authenticating DNS messages via a shared secret (the key). This key is used to generate a hash that is included in the DNS message, allowing both the sender and receiver to verify the integrity and authenticity of the message. By ensuring that the key values are exchanged securely, TSIG helps protect against man-in-the-middle attacks and unauthorized access to sensitive DNS data. The security provided by TSIG is essential for maintaining the integrity of DNS zone transfers, which can contain critical information that could be exploited if compromised. Hence, securing the key exchange process itself is fundamental to the effectiveness of TSIG in preventing attacks on DNS infrastructure. In contrast, other options do not directly relate to the main function of TSIG in the context of secure DNS transactions. For example, unencrypted exchange of key values would completely undermine the purpose of TSIG by allowing potential interception and unauthorized access. The use of multiple NTP sources is relevant to time synchronization but does not pertain directly to DNS zone transfers in the context of TSIG. Finally, while public key infrastructure can enhance security in other contexts, TSIG specifically relies