Examkin

Question

Difficulty: Very hardDNS Lookup and Name Resolution Roles in Enterprise Networks

An enterprise network engineer configures an internal host to resolve domain names via a local Active Directory DNS server, which is configured to forward external queries to a public DNS resolver. During a packet capture analysis on the firewall boundary, the engineer observes that a specific DNS query originating from the internal AD DNS server towards an external authoritative DNS server for a large DNSSEC-signed domain initially uses UDP destination port 53, receives a response with the TrunCation (TC) bit set to 1, and immediately follows up with a new request to the same target server using TCP destination port 53. Which statement accurately explains the fundamental reason for this protocol switch during the name resolution process?

  1. The DNS server switches to TCP because the response payload exceeds the negotiated maximum transmission unit (or 512-byte traditional UDP DNS limit), requiring TCP stream reliability to reassemble and guarantee delivery of large resource record sets.Answer
  2. B
    The DNS server switches to TCP because UDP lacks native sequencing mechanisms, causing the firewall to dynamically force TCP fallback for all recursive domain lookups that require multi-packet reassembly.
  3. C
    The DNS server switches to TCP because authoritative DNS servers only listen on TCP port 53 for recursive lookup requests, while UDP port 53 is strictly reserved for iterative client-to-resolver queries.
  4. D
    The DNS server switches to TCP because DNSSEC security validation requires an initial UDP handshake to authenticate the root hints before opening a persistent TCP control session for payload encryption.

Answer

The DNS server switches to TCP port 53 because the DNS response payload exceeds the maximum supported UDP DNS buffer size, causing the responder to set the TrunCation (TC) bit and prompting the requester to re-query over TCP.
Standard DNS operations use UDP port 53 for fast, lightweight name resolution. However, when a DNS answer payload (such as large DNSSEC resource record sets) exceeds the supported UDP datagram size limit, the responding server truncates the response and sets the TrunCation (TC) flag bit in the DNS header. When the querying DNS entity detects TC=1, standard DNS behavior dictates establishing a TCP connection to port 53 and re-transmitting the query to receive the full, untruncated answer payload.

Step-by-Step Solution

1
Analyze the DNS packet capture details
Identified that the initial UDP query returned a DNS response with the TC (TrunCation) bit set to 1.
The TC bit indicates that the responding server truncated the answer because the payload exceeded the maximum allowable DNS UDP message size.
2
Evaluate transport layer behavior for DNS
DNS operates primarily over UDP port 53 for speed, but falls back to TCP port 53 when responses are truncated.
TCP provides stream-based transmission capable of handling payload sizes larger than the single-datagram UDP limit without losing data integrity.
3
Select the option that correctly describes TC bit functionality and TCP fallback
Confirmed that payload overflow leading to TC=1 triggers an immediate retry over TCP port 53.
This is a core DNS specification behavior defined in RFC 1035 and enhanced by EDNS0.

Key Concept

DNS Transport Layer Mechanics and TC Bit Truncation Fallback
Estimated Time:2m 0s
Rate this question

Topics

DNS Lookup and Name Resolution Roles in Enterprise Networks

More questions from this topic