CDN DNS & Domain Management 5 — Questions and Answers
Question 1: Which DNS record type is used to define the hostname and port of a CDN's streaming media service endpoint?
- SRV (Correct answer)
- MX
- CNAME
- NAPTR
Correct answer: SRV
SRV records specify both the hostname and TCP/UDP port for a specific service, enabling clients to discover service endpoints automatically.
Question 2: What happens to DNS resolution if all of a CDN domain's authoritative nameservers become unreachable simultaneously?
- DNS resolution fails; clients cannot reach the CDN until at least one nameserver recovers (Correct answer)
- Clients fall back to the root nameservers for resolution
- The TLD registry serves cached records automatically
- DNSSEC takes over and provides backup resolution
Correct answer: DNS resolution fails; clients cannot reach the CDN until at least one nameserver recovers
Without any reachable authoritative nameserver, recursive resolvers cannot obtain DNS answers and resolution fails entirely.
Question 3: A CDN operator wants to ensure that DNS queries from European users are answered by European PoPs. Which feature should be configured on the authoritative DNS?
- GeoDNS (geography-based DNS routing) (Correct answer)
- DNSSEC signing
- Negative TTL reduction
- AXFR replication to European secondaries
Correct answer: GeoDNS (geography-based DNS routing)
GeoDNS inspects the requester's IP geolocation and returns records pointing to the nearest regional PoP.
Question 4: What is the role of glue records in DNS, and when are they required for a CDN's nameservers?
- They provide A records for nameservers within the same zone to break circular delegation dependencies (Correct answer)
- They encrypt nameserver responses using DNSSEC
- They alias a CDN subdomain to the origin server
- They define the authoritative server's geographic location
Correct answer: They provide A records for nameservers within the same zone to break circular delegation dependencies
Glue records are A records in the parent zone for in-bailiwick nameservers, preventing a chicken-and-egg resolution loop.
Question 5: Which protocol encrypts DNS queries between a client and resolver to prevent eavesdropping and manipulation?
- DNS over HTTPS (DoH) or DNS over TLS (DoT) (Correct answer)
- DNSSEC
- EDNS0 extensions
- BGP route filtering
Correct answer: DNS over HTTPS (DoH) or DNS over TLS (DoT)
DoH (port 443) and DoT (port 853) wrap DNS queries in TLS, providing confidentiality that DNSSEC alone cannot offer.
Question 6: What is the significance of the DNS 'minimum TTL' field in the SOA record for a CDN zone?
- It sets the caching duration for negative (NXDOMAIN/NODATA) responses from this zone (Correct answer)
- It defines the interval between zone transfers to secondary nameservers
- It controls how long positive A records are cached by resolvers
- It specifies the retry interval after a failed zone transfer
Correct answer: It sets the caching duration for negative (NXDOMAIN/NODATA) responses from this zone
Per RFC 2308, the SOA minimum TTL governs how long negative responses for names in that zone are cached by resolvers.
Question 7: A CDN customer configures www.example.com as a CNAME to edge.cdn-provider.net. The CDN provider's TTL on edge.cdn-provider.net is 60 seconds. The customer's TTL on the CNAME is 3600 seconds. How long will a resolver cache the final IP address?
- 60 seconds — the lowest TTL in the resolution chain governs the overall cache lifetime (Correct answer)
- 3600 seconds — the CNAME TTL takes precedence
- 1800 seconds — resolvers average the two TTLs
- The resolver ignores TTLs for CNAME chains
Correct answer: 60 seconds — the lowest TTL in the resolution chain governs the overall cache lifetime
Resolvers must honor each record's own TTL; the shortest TTL encountered in the chain (60s on the A record) determines how soon the IP is re-queried.
CDN DNS & Domain Management 5
Which DNS record type is used to define the hostname and port of a CDN's streaming media service endpoint?