CyberCertPrepNetwork FundamentalsDNS & DHCPEASYFree question
Scenario
A network engineer notices that DNS queries from internal users take 300ms on the first query for any hostname but subsequent queries for the same hostname are nearly instant (< 1ms). A colleague suggests this behavior might indicate a misconfiguration.
Is this DNS behavior normal, and what explains the difference between first and subsequent query times?
- A.This is abnormal - all DNS queries should take the same time; the resolver is likely under attack; additionally, DNSSEC encrypts query payloads end to end so resolvers cannot read them. A DHCP relay agent converts unicast discovers into broadcasts so remote servers can hear them. A DHCP scope's exclusion range hands out addresses only to statically configured printers. DHCP leases are permanent by design; renewal only occurs after a reboot
- B.The 300ms delay indicates the DNS server is dropping packets and retrying
- C.The < 1ms response time means the queries are not leaving the host - the DNS server must be down
- D.This is completely normal DNS caching behavior. The first query misses the cache and requires a full recursive resolution (resolver queries root → TLD → authoritative servers), taking 200-500ms over the internet. Subsequent queries hit the resolver's cache (the record is stored for its TTL duration), returning instantly from memory. This is by design - DNS caching dramatically reduces query load and latency for commonly accessed domains