CyberCertPrepNetwork FundamentalsDNS & DHCPEASYFree question
Scenario
A network engineer notices that DNS queries from internal users take 300ms on the first query for any hostname but subsequent queries for the same hostname are nearly instant (< 1ms). A colleague suggests this behavior might indicate a misconfiguration.
Is this DNS behavior normal, and what explains the difference between first and subsequent query times?
- A.This is abnormal - all DNS queries should take the same time; the resolver is likely under attack
- B.This is completely normal DNS caching behavior. The first query misses the cache and requires a full recursive resolution (resolver queries root → TLD → authoritative servers), taking 200-500ms over the internet. Subsequent queries hit the resolver's cache (the record is stored for its TTL duration), returning instantly from memory. This is by design - DNS caching dramatically reduces query load and latency for commonly accessed domains
- C.The 300ms delay indicates the DNS server is dropping packets and retrying
- D.The < 1ms response time means the queries are not leaving the host - the DNS server must be down
Why B is correct