Examkin

Question

Difficulty: HardCommon Ports and Protocols

A network administrator is configuring internal perimeter firewall rules between two subnets. Hosts on Subnet A can successfully resolve domain names using the primary DNS server on Subnet B via standard queries. However, a secondary DNS server on Subnet A fails to perform complete zone database transfers (AXFR) from the primary server. Which transport protocol and destination port combination must be permitted on the firewall to allow secondary DNS zone transfers to succeed?

  1. TCP port 53Answer
  2. B
    UDP port 53
  3. C
    TCP port 853
  4. D
    UDP port 67

Answer

TCP port 53 must be permitted on the firewall to enable DNS zone replication between primary and secondary servers.
Standard client DNS queries rely on UDP port 53 for fast, lightweight name resolution. However, zone transfers (AXFR/IXFR) involve replicating entire DNS database records between servers, which demands the connection reliability, error checking, and data framing provided by TCP port 53.

Step-by-Step Solution

1
Differentiate between client DNS resolution and DNS zone transfers.
Client resolution requests use small Datagram PDU traffic, whereas zone transfers (AXFR) transmit complete resource record databases.
Small lookup requests fit within standard UDP packet size limits, while database sync requires guaranteed packet delivery.
2
Determine transport protocol requirements for bulk zone data.
Transmission Control Protocol (TCP) ensures in-order delivery and retransmission of lost packets during database replication.
Connectionless UDP cannot guarantee integrity for large, multi-packet zone file syncs.
3
Identify the required port and protocol pair.
DNS uses port 53 for both transport protocols; zone transfers specifically operate over TCP port 53.
Permitting TCP port 53 through the firewall resolves the secondary DNS server synchronization failure.

Key Concept

DNS Transport Protocol Selection (UDP 53 vs TCP 53)
Rate this question

Topics

Common Ports and Protocols

More questions from this topic