Examkin

Question

Difficulty: Very hardDNS Infrastructure and Record Types

A network security engineer is investigating a DNS operational failure between an internal primary name server and a DMZ-hosted secondary name server following a firewall policy hardening exercise. The secondary server fails to perform full zone transfers (AXFR), and external resolvers fail to receive DNSSEC-signed responses that exceed 512 bytes. The engineer executes the following diagnostic command from the secondary server:

text
$ dig @172.16.10.10 example.com AXFR +dnssec
;; Truncation detected; requesting TCP fallback...
;; Connection failed: connection timed out
;; Communications error to 172.16.10.10#53: timed out

Which protocol behavior explains these combined failures, and what resolution must be implemented on the perimeter firewall?

  1. Zone transfers (AXFR) and truncated DNS responses (TC flag set) require TCP port 53 transport; the firewall must be updated to allow inbound and outbound TCP port 53 traffic between the name servers.Answer
  2. B
    DNS zone transfers and large payload responses operate exclusively over UDP port 53; the primary server must be reconfigured to split records into multiple CNAME alias entries to avoid packet loss.
  3. C
    Fallback from UDP to TCP occurs only during administrative diagnostic queries; the firewall should maintain a block on TCP port 53 and instead rely on UDP port 53 with larger MTU sizing.
  4. D
    DNSSEC enforcement and zone synchronization require secure shell transport; the firewall policy must be modified to permit traffic targeted to SSH on TCP port 22.

Answer

Zone transfers (AXFR) and truncated DNS responses (TC flag set) require TCP port 53 transport; the firewall must be updated to allow inbound and outbound TCP port 53 traffic between the name servers.
DNS relies on both UDP and TCP on port 53. While standard lookup queries utilize UDP for speed and low overhead, zone transfers (AXFR) and responses that exceed maximum UDP payload sizes (such as large DNSSEC key responses) trigger the Truncation (TC) flag in the DNS header. When the TC flag is set, the client or secondary server MUST re-query over TCP port 53. If a firewall blocks TCP port 53, both zone transfers and large DNSSEC query resolutions will fail.

Step-by-Step Solution

1
Analyze the diagnostic command output.
The `dig` output shows `Truncation detected; requesting TCP fallback...` followed by a timeout on port 53.
When a DNS response exceeds the allowable UDP buffer size or when initiating zone transfers (AXFR/IXFR), DNS transitions from UDP to TCP port 53.
2
Identify transport layer requirements for DNS Infrastructure.
Both full zone transfers (AXFR) and truncated DNSSEC queries require functional TCP port 53 communication.
UDP port 53 is used for standard small queries, but TCP port 53 is mandatory for reliable bulk data delivery (zone transfers) and fallback for oversized responses.
3
Determine the firewall remediation.
Permit TCP port 53 traffic between the primary and secondary DNS servers on the perimeter firewall.
Allowing TCP port 53 enables secondary servers to complete AXFR zone synchronization and resolves DNSSEC payload truncation fallbacks.

Key Concept

DNS Transport Layer Selection (UDP 53 vs TCP 53) and AXFR Zone Transfer Operations
Estimated Time:3m 0s
Rate this question

Topics

DNS Infrastructure and Record Types

More questions from this topic