The private KSK and ZSK are provided via a DNSKEY resource record.

NSEC and NSEC3 records are used to digitally sign non-existent records.

A glue record is a helper recod, that logically belongs to another zone.

DNS uses both, UDP and TCP, as transport protocols.

Tick all valid resource records types!

Imagine the real Internet: You are using a client system and try to open "www.hackertyper.com" in a Web browser. All caches on your client as well as on the resolver configured in your network settings are empty. Assume that DNSSEC is NOT available!

Describe which servers and zones are involved and which DNS requests/responses are exchanged in their respective order and where iterative and recursive requests are used!

Forward- and Reverse Lookups must always consistently point to each other.

For working DNSSEC, the whole chain up to the root must be signed.

A client will only accept authoritative answers.

Multiple A records can point to a single IP address.