DNS — end of module

What this checks. That you can read a response code as an answer, and say what a name resolution does and does not reveal. You need 3 of 4 to pass, and every option is explained afterwards — including the ones you did not pick.

1. 1/4One site fails instantly while everything else works. The capture shows a query and a response with rcode 3 and no answer records. What happened?

   Diagnose a failure

   The name does not exist — the resolver answered NXDOMAIN

   The resolver is down

   The web server is refusing connections
2. 2/4What is the difference between a recursive resolver and an authoritative server?

   Tell two ideas apart

   A recursive resolver does the walking on your behalf; an authoritative server answers only for the zones it holds

   A recursive resolver caches and an authoritative server does not

   Authoritative servers use TCP and recursive resolvers use UDP
3. 3/4Someone says 'we use HTTPS, so an observer cannot tell which sites we visit'. What does the DNS stage of a capture show?

   Say why an answer is wrong

   An ordinary plaintext query naming the site, sent before TLS has done anything at all

   Nothing — DNS is encrypted by default

   Only the resolver's address, never the name
4. 4/4A record's TTL is 300. An operator changes the address and expects the change to be immediate. What should they be told?

   Apply it somewhere new

   Resolvers that already have the old answer may keep serving it for up to five more minutes, and the TTL should have been lowered in advance

   The change takes effect immediately because the authoritative server updated

   Nothing will change until the record is deleted and recreated