Examkin

Question

Difficulty: HardDNS Infrastructure and Record Types

A network administrator is attempting to perform a manual zone transfer from an authoritative internal DNS server at 192.168.10.5192.168.10.5 for the domain internal.corp.cominternal.corp.com. While standard host resolution queries function normally, the zone transfer fails as shown in the command output below:

text
$ dig @192.168.10.5 internal.corp.com AXFR
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

Which of the following firewall configuration changes is required to resolve this DNS operational failure?

  1. Allow inbound traffic to destination TCP port 53 on the DNS server.Answer
  2. B
    Configure the client query to enforce UDP port 53 with the +notcp flag, as zone transfers are restricted to connectionless transport.
  3. C
    Change the query record type from AXFR to CNAME to retrieve the complete domain zone structure.
  4. D
    Permit inbound traffic to destination UDP port 5353 to enable zone transfer replication across local subnets.

Answer

Allow inbound traffic to destination TCP port 53 on the DNS server.
DNS primary/secondary replication and manual zone transfers utilize the AXFR query type. Unlike standard lookup queries that run over UDP port 53, zone transfers require TCP port 53 to handle bulk data delivery securely and reliably without packet truncation. Opening TCP port 53 allows the client connection to establish successfully.

Step-by-Step Solution

1
Analyze the failed query command and output snippet.
The administrator attempted an Authoritative Transfer (AXFR) query against server 192.168.10.5192.168.10.5 using `dig`, resulting in a connection timeout.
Standard DNS resolution queries use UDP port 53, but AXFR operations require TCP port 53 due to data size and reliability requirements.
2
Evaluate transport layer requirements for DNS zone transfers.
Because standard DNS UDP queries succeeded while AXFR timed out, the intermediate firewall or host firewall is blocking TCP port 53 traffic while permitting UDP port 53.
AXFR transfers transmit the complete database of a DNS zone, which typically exceeds maximum UDP packet boundaries (512512 bytes without EDNS0) and requires TCP connection state.
3
Select the correct remediation policy.
Updating firewall rules to permit inbound traffic on TCP port 53 enables the client to establish a TCP handshake and complete the AXFR request.
Opening TCP port 53 fulfills the connection requirement without modifying valid query syntax or incorrectly altering transport protocols.

Key Concept

DNS Transport Protocols (UDP vs TCP Port 53)
Estimated Time:2m 0s
Rate this question

Topics

DNS Infrastructure and Record Types

More questions from this topic