Examkin

Question

Difficulty: MediumDNS Infrastructure and Record Types

A network administrator notices that client workstations can successfully resolve domain names using standard DNS queries. However, full DNS zone transfers (AXFR) between the primary and secondary authoritative DNS servers consistently fail across a newly installed internal firewall. Which of the following transport layer configurations is required on the firewall to allow zone transfers to complete successfully?

  1. Permit traffic on TCP port 53 between the primary and secondary DNS servers.Answer
  2. B
    Permit traffic on UDP port 5353 between the primary and secondary DNS servers.
  3. C
    Reconfigure the zone sync mechanism to send iterative PTR records over UDP port 53.
  4. D
    Force the secondary DNS server to request zone transfers using UDP port 53.

Answer

Permitting traffic on TCP port 53 allows the primary and secondary DNS servers to establish a reliable, connection-oriented session needed for transmitting complete DNS zone transfer databases.
DNS relies on UDP port 53 for standard hostname lookups due to low overhead, but uses TCP port 53 for zone transfers (AXFR/IXFR) and responses that exceed standard datagram limits. Allowing TCP port 53 traffic through the firewall enables the secondary DNS server to pull zone data reliably.

Step-by-Step Solution

1
Analyze the difference between standard DNS lookup traffic and DNS zone replication.
Standard client queries use small UDP datagrams (UDP port 53), while zone transfers (AXFR) send large data structures requiring connection reliability.
UDP packets are limited in size (traditionally 512 bytes without EDNS0) and lack connection state verification for complete database transfers.
2
Identify the protocol and port requirements for DNS zone transfers (AXFR).
Zone transfers strictly require TCP port 53.
TCP ensures ordered delivery, retransmission of lost packets, and supports payloads larger than standard UDP limits.
3
Determine the necessary firewall rule change.
Allow TCP port 53 traffic between the primary and secondary DNS server IP addresses.
Opening TCP port 53 permits the secondary server to initiate and receive full zone transfers.

Key Concept

DNS Transport Protocols (UDP 53 vs TCP 53)
Estimated Time:1m 15s
Rate this question

Topics

DNS Infrastructure and Record Types

More questions from this topic