ip dns spoofing Command Result on DNS Queries | CCIE Security Exam
Question
In Cisco IOS, what is the result of the ip dns spoofing command on DNS queries that are coming from the inside and are destined to DNS servers on the outside?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.B.
The ip dns spoofing command is used to prevent DNS spoofing attacks on the router. DNS spoofing is a type of attack in which an attacker redirects DNS queries to a malicious DNS server that returns false information. This can be used to redirect traffic to malicious websites, steal login credentials, or perform other types of attacks.
The ip dns spoofing command is used to prevent this type of attack by verifying that the DNS packets received on the outside interface have a valid TSIG (Transaction Signature) signature. TSIG is a mechanism for authenticating DNS messages between two endpoints. If the TSIG signature is invalid, the DNS packet is dropped.
However, the question asks specifically about DNS queries that are coming from the inside and are destined to DNS servers on the outside. In this case, the ip dns spoofing command does not have any effect. The reason is that the ip dns spoofing command only affects DNS packets received on the outside interface. DNS queries coming from the inside interface are not affected.
Therefore, the correct answer is D, "The router will block unknown DNS requests on both the inside and outside interfaces." This is the default behavior of Cisco IOS when the ip dns spoofing command is not configured. When the router receives a DNS query on either the inside or outside interface, it checks to see if it has a valid cache entry for the requested domain. If it does not have a valid cache entry, it forwards the query to the configured DNS server on the appropriate interface. If the DNS server does not respond within a configurable timeout period, the query is dropped. If the DNS server responds with an unknown domain, the query is dropped.
In summary, the ip dns spoofing command is used to prevent DNS spoofing attacks on the outside interface of a Cisco IOS router. It does not affect DNS queries coming from the inside interface. When the command is not configured, the router blocks unknown DNS requests on both the inside and outside interfaces.
