What configuration enables a Citrix ADC acting as DNS proxy to alter the AA bit in DNS responses?

• A. Change TTL in DNS response
• B. Unset the AA bit of DNS Response
• C. Set the AA bit in DNS Request
• D. Set the AA bit in DNS Response

Answer: (D)

The AA bit is the Authoritative Answer flag in the DNS header, and it is part of the DNS response. To indicate that the response comes from an authoritative source for the queried zone, the appliance must set this bit in the DNS response. A DNS proxy like Citrix ADC can only influence this by marking the outgoing response as authoritative for that zone, which is why the configuration involves setting the AA bit in the DNS response.

Changing the TTL affects caching behavior, not authoritativeness. Unsetting the AA bit in the response would make the reply non-authoritative, which is the opposite of what you’d want if you’re trying to indicate authority. Setting the AA bit in the request is not meaningful, since the flag is used and interpreted in responses, not requests.