Examkin

Question

Difficulty: HardTroubleshooting DNS and Name Resolution Services

A network technician is troubleshooting DNS resolution issues on a branch office workstation. The workstation is configured to use the local branch gateway router (192.168.10.1192.168.10.1) as its primary DNS server, which should forward requests for internal corporate resources to the core DNS server (10.100.1.510.100.1.5).

When attempting to resolve an internal hostname, the technician runs the following command-line queries from the workstation:

text
$ nslookup intranet.corp.local
Server: 192.168.10.1
Address: 192.168.10.1#53

** server can't find intranet.corp.local: SERVFAIL

$ nslookup intranet.corp.local 10.100.1.5
Server: 10.100.1.5
Address: 10.100.1.5#53

Name: intranet.corp.local
Address: 10.100.20.50

Based on the output, which TWO of the following are the most likely root causes for the initial resolution failure? (Select TWO.)

  1. The DNS forwarder configuration on the local router (192.168.10.1) is specified with an incorrect or unreachable upstream DNS server IP address.Answer
  2. An Access Control List (ACL) or firewall rule is blocking port 53 UDP/TCP traffic originating from the router's IP address to the core DNS server.Answer
  3. C
    The core DNS server (10.100.1.5) is missing an authoritative A record for intranet.corp.local in its primary lookup zone.
  4. D
    The nslookup command bypassed network DNS servers and evaluated a stale entry in the local workstation's HOSTS file.

Answer

The initial resolution failure is most likely caused by either an incorrect upstream DNS server IP address configured in the local router's DNS forwarder settings, or an Access Control List (ACL) / firewall rule blocking DNS port 53 traffic sourcing from the router's IP address to the core DNS server.
The output demonstrates that the workstation can directly query the core DNS server at 10.100.1.5 and receive an authoritative A record response. However, querying the local router at 192.168.10.1 yields a SERVFAIL error. This error occurs when a DNS server cannot fulfill a query due to an upstream failure. This indicates either that the router is attempting to forward requests to an incorrect/unreachable upstream IP address configured in its forwarding list, or that intermediate network security controls (ACLs/firewalls) are blocking port 53 traffic originating specifically from the router's IP address.

Step-by-Step Solution

1
Analyze the first command output (`nslookup intranet.corp.local`).
The query sent to the local gateway (192.168.10.1192.168.10.1) returns a `SERVFAIL` error response.
`SERVFAIL` indicates that the DNS server received the request but encountered an internal failure (such as an inability to communicate with upstream recursive/authoritative servers) while attempting to process it.
2
Analyze the second command output (`nslookup intranet.corp.local 10.100.1.5`).
Direct query to the core DNS server (10.100.1.510.100.1.5) successfully resolves `intranet.corp.local` to IP address 10.100.20.5010.100.20.50.
This confirms that the host record exists, the core DNS server is operational, and the workstation itself has IP connectivity to port 53 on 10.100.1.510.100.1.5.
3
Deduce why querying the router fails while querying the core server directly succeeds.
Identify issues specific to the relay path between 192.168.10.1192.168.10.1 and 10.100.1.510.100.1.5.
Because the workstation can reach 10.100.1.510.100.1.5, any path failure must affect traffic originating from 192.168.10.1192.168.10.1 specifically (such as router-sourced ACL restrictions) or an internal misconfiguration on 192.168.10.1192.168.10.1 (such as an incorrect forwarder destination IP address).

Key Concept

DNS Forwarder and Relay Troubleshooting
Rate this question

Topics

Troubleshooting DNS and Name Resolution Services

More questions from this topic