_____ is a set of extensions to DNS that provide the origin authentication of DNS...

The correct answer is C. DNSSEC (Domain Name System Security Extensions). DNSSEC is a collection of security extensions designed to protect the Domain Name System (DNS) from attacks such as DNS cache poisoning, DNS spoofing, and forged DNS responses. Traditional DNS was not originally designed with strong authentication mechanisms, making it vulnerable to attackers who could redirect users to malicious websites by manipulating DNS records.

DNSSEC addresses this weakness by using public key cryptography and digital signatures to verify the authenticity and integrity of DNS data. When a DNS resolver receives a response, it can validate the digital signature associated with the DNS record to ensure that the information originated from the legitimate DNS zone and has not been altered during transmission.

Option A (Resource transfer) is not a DNS security mechanism. Option B (Resource records) are standard DNS database entries such as A, AAAA, MX, and CNAME records. Option D (Zone transfer) is a DNS replication mechanism used between DNS servers and does not provide authentication or protection against spoofing.

CEH Exam Tip:

DNSSEC = DNS Authentication + Integrity Verification + Protection Against DNS Poisoning and Spoofing Attacks.