The primary purpose of Domain Name System (DNS) is to resolve host names to IP addresses. If you’re planning on taking the Security+ exam or Network+ exam, you should have a basic understanding of DNS servers. For example, can you answer this question?
Q. You need to reboot your DNS server. Of the following choices, which type of server are you MOST likely to reboot?
A. Unix server
B. Apache server
C. BIND server
D. Web server
More, do you know why the correct answer is correct and the incorrect answers are incorrect?
The answer and explanation is available at the end of this post.
The 601 Version of the Study Guide
The CompTIA Security+: Get Certified Get Ahead: SY0-601 Study GuideEach of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.
You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.
Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:
- A 75 question pre-test
- A 75 question post-test
- Practice test questions at the end of every chapter.
Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.
If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-601 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.
Understanding DNS
Systems are constantly querying DNS, though it is usually transparent to users. As an example, imagine that you want to visit https://blogs.getcertifiedgetahead.com/. You enter the URL into your web browser or click a link on a page and your system queries a DNS server for the site’s IP address. Figure 3.2 shows what is occurring between your system and DNS. DNS uses UDP port 53 for these types of queries.
DNS servers host data in zones, which you can think of as a database. Zones include multiple records, including the following:
- A. A record (also called a host record). This record holds the host name and IPv4 address and is the most commonly used record in a DNS server. A DNS client queries DNS with the name using a forward lookup request, and DNS responds with the IPv4 address from this record.
- AAAA. This record holds the host name and IPv6 address. It’s similar to an A record except that it is for IPv6.
- PTR. Also called a pointer record. It is the opposite of an A record. Instead of a DNS client querying DNS with the name, the DNS client queries DNS with the IP address. When configured to do so, the DNS server responds with the name. PTR records are optional so these reverse lookups do not always work.
- MX. Also called mail exchanger. An MX record identifies a mail server used for email. The MX record is linked to the A record or AAAA record of a mail server.
- CNAME. A canonical name, or alias, allows a single system to have multiple names associated with a single IP address. For example, a server named Server1 in the domain GetCertifiedGetAhead.com might have an alias of FileServer1 in the same domain.
Most DNS servers on the Internet run Berkeley Internet Name Domain (BIND) software and run on Unix or Linux servers. Internal networks can use BIND, but in Microsoft networks, most DNS servers use the Microsoft DNS software.
Occasionally, DNS servers share information with each other in a process known as a zone transfer. In most cases, a zone transfer only includes a small number of updated records. However, some transfers include all the records in the zone. DNS servers use TCP port 53 for zone transfers. In contrast, name resolution queries use UDP port 53.
It’s easy to overlook the amount and value of information available in a DNS server. However, if attackers are able to access zone data on an internal DNS server, they can map out an entire network. It lists all the names and IP addresses, and identifies some specific servers such as mail servers. Because of this, DNS administrators configure DNS servers to use secure zone transfers to prevent unauthorized modifications of zone data, and to prevent unauthorized zone transfers.
Remember this
DNS zones include records such as A records for IPv4 addresses and AAAA records for IPv6 addresses. DNS uses TCP port 53 for zone transfers and UDP port 53 for DNS client queries. Most Internet-based DNS servers run BIND software on Unix or Linux servers, and it’s common to configure DNS servers to only use secure zone transfers.
Q. You need to reboot your DNS server. Of the following choices, which type of server are you MOST likely to reboot?
A. Unix server
B. Apache server
C. BIND server
D. Web server
Answer is C. Berkeley Internet Name Domain (BIND) is a type of Domain Name System (DNS) software commonly used on the Internet and in some internal networks, so a BIND server is a DNS server.
BIND runs on Unix servers, but not all Unix servers are BIND servers.
Apache is a type of web server software that runs on Unix and Linux systems.
You might also like to view the blog post about DNS Attacks.
