CDN DNS & Domain Management 2 — Questions and Answers
Question 1: What DNS record type is used to map a hostname to an IPv6 address?
- AAAA (Correct answer)
- A
- PTR
- CNAME
Correct answer: AAAA
AAAA records map hostnames to 128-bit IPv6 addresses, while A records handle IPv4.
Question 2: Which DNS failover strategy routes traffic to a backup CDN origin only when health checks fail?
- Active-passive failover (Correct answer)
- Round-robin DNS
- Anycast routing
- GeoDNS balancing
Correct answer: Active-passive failover
Active-passive failover keeps a secondary endpoint idle until the primary fails a health check.
Question 3: A CDN provider uses DNS-based load balancing to distribute users across PoPs. What latency metric does the DNS resolver typically use to select the nearest PoP?
- RTT to the resolver's IP (Correct answer)
- BGP AS path length
- HTTP response time
- TCP handshake count
Correct answer: RTT to the resolver's IP
CDN authoritative DNS servers measure round-trip time (RTT) from the resolver's IP to select the closest PoP.
Question 4: What is the purpose of DNSSEC's RRSIG record?
- It contains a cryptographic signature over a DNS record set (Correct answer)
- It maps IP addresses to hostnames
- It delegates a zone to a child nameserver
- It specifies the mail server for a domain
Correct answer: It contains a cryptographic signature over a DNS record set
RRSIG holds the digital signature for a resource record set, allowing resolvers to verify authenticity.
Question 5: When a CDN edge node receives a DNS query for content.example.com, which authoritative server is ultimately responsible for answering?
- The authoritative nameserver listed in example.com's NS records (Correct answer)
- The root nameserver
- The ISP's recursive resolver
- The CDN's anycast PoP
Correct answer: The authoritative nameserver listed in example.com's NS records
The authoritative nameserver designated by the domain's NS records holds the final, definitive answer for that zone.
Question 6: What DNS record would you add to verify domain ownership to a CDN provider during onboarding?
- TXT record (Correct answer)
- MX record
- SOA record
- SRV record
Correct answer: TXT record
CDN providers commonly require a TXT record with a provider-supplied verification token to prove domain control.
Question 7: Which DNS attack exploits a vulnerable resolver to redirect users to a malicious IP by poisoning its cache?
- DNS cache poisoning (Correct answer)
- DNS amplification
- NXDOMAIN hijacking
- Zone transfer attack
Correct answer: DNS cache poisoning
DNS cache poisoning inserts forged records into a resolver's cache, redirecting victims without their knowledge.
CDN DNS & Domain Management 2
What DNS record type is used to map a hostname to an IPv6 address?