Examkin

Question

Difficulty: HardFirewalls and Access Control Lists (ACLs)

A network engineer is configuring a stateless Access Control List (ACL) on a router interface connecting an internal subnet (10.100.10.0/2410.100.10.0/24) to an external gateway. To permit outbound DNS name resolution to a public DNS server (8.8.8.88.8.8.8), the engineer applies the following outbound ACL entry on the router interface:

`permit udp 10.100.10.0 0.0.0.255 host 8.8.8.8 eq 53`

After applying this configuration, internal client hosts are still unable to resolve domain names. Packet captures confirm outbound DNS query packets are leaving the interface, but clients never receive answers. Which of the following best explains why the DNS resolution is failing?

  1. The stateless ACL drops the return DNS reply traffic from port 53 because it does not maintain session state and lacks an inbound permit rule for return traffic.Answer
  2. B
    DNS queries strictly require TCP port 53 for standard name resolution requests, causing the router to drop the UDP-configured traffic before forwarding.
  3. C
    The ACL lacks an explicit deny statement at the end of the rule list, causing the router to default to permitting all return traffic without processing the match statement.
  4. D
    Standard client DNS queries originate from destination port 5353 rather than port 53, causing the ACL filter criteria to fail to match outbound packet headers.

Answer

The DNS resolution fails because the stateless ACL filtering outbound traffic does not dynamically track connection state, causing the returning DNS response packets from the DNS server to be dropped by the implicit deny rule on the return path.
Stateless Access Control Lists (ACLs) do not monitor connection state tables or track session handshakes. While the outbound permit rule allows client DNS requests to reach external server 8.8.8.8, the return DNS answer packets originating from 8.8.8.8 port 53 back to the client are evaluated independently. Without a corresponding return permit rule on the incoming traffic path, the return packets hit the implicit deny at the end of the ACL structure and are dropped.

Step-by-Step Solution

1
Analyze the operational difference between stateful firewalls and stateless access control lists.
Stateless filters treat every packet independently and do not inspect or maintain connection state tables for active flows.
Because stateless ACLs do not record outbound connection attempts, return packets are not automatically recognized or allowed back through the interface.
2
Trace the bidirectional traffic flow of a DNS query.
The outbound packet (Source: 10.100.10.x10.100.10.x:ephemeral_port, Destination: 8.8.8.88.8.8.8:53) matches the outbound permit rule and leaves the router. The return packet (Source: 8.8.8.88.8.8.8:53, Destination: 10.100.10.x10.100.10.x:ephemeral_port) arrives at the interface.
Without an inbound ACL entry permitting UDP traffic from source host 8.8.8.88.8.8.8 port 53 back to internal ephemeral ports, the return packet encounters the implicit deny.
3
Identify the required remedy for stateless packet filtering.
An explicit return rule must be configured (or a stateful firewall architecture implemented) to permit traffic originating from host 8.8.8.88.8.8.8 port 53 returning to 10.100.10.0/2410.100.10.0/24.
This completes the bidirectional communication path necessary for client-server protocol interaction.

Key Concept

Stateless vs. Stateful Packet Filtering in ACLs
Estimated Time:2m 0s
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic