Examkin

Question

Difficulty: MediumTroubleshooting DNS and Name Resolution Services

A network administrator is troubleshooting an issue where a Windows client workstation fails to resolve internal hostnames. To isolate where name resolution fails within the OS lookup hierarchy, in what order does a standard Windows client attempt to resolve a target hostname? Arrange the following resolution mechanisms from first evaluated (top) to last evaluated (bottom).

  1. 1Inspect the local client DNS cache and local HOSTS file (%SystemRoot%\System32\drivers\etc\hosts).
  2. 2Send a unicast DNS query to the primary configured DNS server over UDP/TCP port 53.
  3. 3Transmit Link-Local Multicast Name Resolution (LLMNR) requests on UDP port 5355 across the local subnet.
  4. 4Broadcast NetBIOS Name Service (NBT-NS) query requests on UDP port 137 over the local broadcast domain.

Answer

The correct evaluation sequence for Windows name resolution is: 1) Inspect local DNS cache and HOSTS file, 2) Send a unicast DNS query to the primary configured DNS server, 3) Transmit LLMNR requests on the local subnet, 4) Broadcast NetBIOS Name Service (NBT-NS) requests.
The Windows operating system follows a strict, deterministic sequence for host name resolution: local cache and HOSTS file lookup occurs first, followed by unicast queries to configured DNS servers, then local subnet multicast via LLMNR, and finally legacy NetBIOS (NBT-NS) broadcasts.

Step-by-Step Solution

1
Evaluate local host resources
The operating system checks memory (DNS resolver cache) and local configuration files (HOSTS) first to avoid unnecessary network traffic.
Local lookup requires zero network overhead and provides immediate response if a mapping exists.
2
Query configured network DNS servers
The OS queries the primary DNS server IP configured on the active network interface over port 53.
Centralized DNS resolution is the primary method for resolving domain hostnames across local networks and the internet.
3
Initiate local multicast fallback via LLMNR
If the DNS server is unreachable or responds with Name Error (NXDOMAIN), the client sends LLMNR multicast packets on UDP 5355.
LLMNR allows peer-to-peer name resolution on the local link without requiring a centralized DNS server.
4
Initiate legacy broadcast fallback via NBT-NS
If LLMNR produces no response, Windows defaults to NetBIOS Name Service broadcasts over UDP 137.
NBT-NS provides backward compatibility with legacy Windows networking environments.

Key Concept

Windows Client Name Resolution Order
Rate this question

Topics

Troubleshooting DNS and Name Resolution Services

More questions from this topic