Examkin

Question

Difficulty: HardUtilizing Command-Line Network Troubleshooting Utilities

A network engineer is investigating why client workstations cannot establish a secure web session to an internal web service at `https://app.corp.local`. The engineer executes two CLI diagnostic commands:

1. On the Linux web server host:
text
$ ss -tuln
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
tcp LISTEN 0 128 0.0.0.0:80 0.0.0.0:*

2. On a client workstation:
text
$ nslookup app.corp.local 192.168.10.5
Server: dns01.corp.local
Address: 192.168.10.5

Non-authoritative answer:
Name: app.corp.local
Address: 10.20.30.100

Based on the output of these command-line utilities, which TWO statements accurately diagnose the network status and root cause of the connection failure?

  1. The target web application daemon is currently bound to and listening on TCP port 80 (HTTP) rather than TCP port 443 (HTTPS).Answer
  2. Name resolution for `app.corp.local` successfully resolved to IP address 10.20.30.100, confirming that DNS resolution is functioning properly.Answer
  3. C
    The DNS lookup failed because the response was returned by a non-authoritative server, indicating an invalid or corrupted DNS record.
  4. D
    The web server must be reconfigured to query MX records on TCP port 53 before it can accept incoming HTTPS client sessions.

Answer

The web service process is listening on TCP port 80 instead of TCP port 443, and the DNS resolution for the host is functioning correctly.
Analyzing `ss -tuln` reveals the server is listening for HTTP traffic on TCP port 80 rather than HTTPS on TCP port 443, explaining why HTTPS connections fail. Additionally, `nslookup` successfully resolves `app.corp.local` to `10.20.30.100`, establishing that DNS resolution is functioning properly.

Step-by-Step Solution

1
Analyze the output of `ss -tuln` on the web server host
Identified an active TCP listening socket on `0.0.0.0:80`, demonstrating that the daemon is listening for unencrypted HTTP traffic on port 80 rather than encrypted HTTPS traffic on port 443.
HTTPS requires a service listening on TCP port 443. Traffic sent to port 443 will be rejected when no process is listening on that port.
2
Analyze the output of `nslookup app.corp.local 192.168.10.5` on the client workstation
Confirmed that the hostname resolves to IP address `10.20.30.100`.
A valid IP address response confirms Layer 7 name resolution is working, regardless of whether the answer was served from cache (non-authoritative).

Key Concept

Interpreting network troubleshooting CLI utility outputs (`ss` / `netstat` socket states and `nslookup` DNS responses)
Rate this question

Topics

Utilizing Command-Line Network Troubleshooting Utilities

More questions from this topic