Examkin

Question

Difficulty: HardTroubleshooting DNS and Name Resolution Services

A network administrator is troubleshooting an issue where remote access VPN users cannot resolve names for specific corporate subdomains. Standard DNS queries for small records complete successfully, but queries that return large payload responses fail. The technician executes the following command on an affected client workstation:

$ nslookup -vc large-record.corp.internal 10.100.1.2
Server: dns1.corp.internal
Address: 10.100.1.2

DNS request timed out.
timeout was 2 seconds.
*** Request to dns1.corp.internal timed out

Which of the following is the most likely root cause of this failure?

  1. An intermediate firewall along the VPN path is blocking TCP port 53 traffic required for truncated DNS responses.Answer
  2. B
    The client workstation is configured to use UDP port 530 instead of standard UDP port 53 for name resolution.
  3. C
    The primary DNS zone is missing a PTR record for the internal server 10.100.1.2.
  4. D
    The local DNS resolver cache on the client has been corrupted by a stale CNAME record.

Answer

An intermediate firewall along the VPN path is blocking TCP port 53 traffic required for truncated DNS responses.
DNS primarily operates over UDP port 53 for standard short queries. However, when a response payload exceeds the maximum UDP packet size, or when using command flags like `-vc` in `nslookup` (which forces Virtual Circuit / TCP mode), DNS relies on TCP port 53. If an intermediate firewall permits UDP port 53 but blocks TCP port 53, normal small queries succeed while large responses or forced TCP queries time out.

Step-by-Step Solution

1
Analyze the nslookup command syntax and flags.
The `-vc` flag explicitly forces nslookup to establish a Virtual Circuit connection using TCP instead of UDP.
Understanding tool flags isolates whether the failure is specific to TCP transport.
2
Evaluate the command output error message.
The output indicates `DNS request timed out`, meaning the client sent a TCP segment to 10.100.1.2:53 but received no response (SYN dropped or blocked).
Connection timeouts on specific protocol transports typically point to network filtering or firewall rules.
3
Correlate TCP behavior with large DNS responses.
DNS queries that exceed the UDP payload size limit set the Truncation (TC) flag, prompting clients to retry over TCP port 53.
If TCP port 53 is blocked by a network firewall, any large DNS response or forced TCP query (-vc) will fail with a timeout.

Key Concept

DNS Transport Protocols (UDP vs TCP Port 53)
Estimated Time:2m 0s
Rate this question

Topics

Troubleshooting DNS and Name Resolution Services

More questions from this topic