Your network contains an Active Directory domain named contoso.com. The network contains a domain
controller named DC1 that has to DNS Server server role installed. DC1 has a standard primary DNS zonefor
contoso.com.
You need to ensure that only client computers in the contoso.com domain will be able to add their records to
the contoso.com zone.
What should you do first?

A.
Modify the Security settings of Dc1.

B.
Modify the Security settings of the contoso.com zone.

C.
Store the contoso.com zone in Active Directory.

D.
Sign the contoso.com zone.

Explanation:
C: Only Authenticated users can create records whenzone is stored in AD Secure dynamic updates allow an
administrator to control what computers update whatnames and preventunauthorized computers from
overwriting existing names in DNS.
If you have an Active Directory infrastructure, youcan only use Active Directoryintegrated zones on
ActiveDirectory domain controllers.
If you are using Active Directoryintegrated zones, you must decide whether or not to store Active Directoryintegrated zones in the Application directory partition.
To configure computers to update DNS data more securely, store DNS zones in Active Directory
DomainServices (AD DS) and use the secure dynamic update feature. Secure dynamic update restricts DNS
zone updates to only those computers that are authenticated and joinedto the Active Directory domain where
the DNS server is located and to the specific security settings that aredefined in the access control lists (ACLs)
for the DNS zone.
http://technet.microsoft.com/en-us/library/cc731204(v=ws.10).aspx http://technet.microsoft.com/en-us/library/
cc755193.aspx http://technet.microsoft.com/en-us/library/cc786068%28v=ws.10%29.aspx