Domain Security Fundamentals — assessment

Sample question

You publish a TXT record. A colleague on another network cannot see it. Which single check tells you whether you published it correctly, as distinct from whether caches have caught up?

• Query the zone’s own authoritative nameserver directly.An authoritative server answers from the zone rather than from cache, so it tells you what you actually published. That separates "I published the wrong thing" from "I published the right thing and a resolver has not expired its copy" — two problems with completely different responses.
• Query a public resolver such as 1.1.1.1.That tells you what the world currently sees, which is useful second. It cannot distinguish a bad record from a stale cache, because both look like a wrong answer.
• Compare the record against your provider’s control panel.The panel shows what it stored, not what its servers answer. The gap between those two is exactly where this class of problem lives.
• Wait for the TTL to elapse and check again.Eventually informative and it is a guess rather than a check — and if the record is genuinely wrong you have spent the TTL learning nothing.

Every option carries an explanation, including the wrong ones.