Examkin

Soru

Zorluk: ZorCommon Ports and Protocols

A network security administrator is configuring firewall rules between two corporate sites connected via an IPsec VPN tunnel. Client machines on the remote site can successfully resolve domain names using UDP queries to the primary DNS server. However, automated secondary DNS server zone transfers (AXFR) across the VPN continuously time out and fail to synchronize database records. Which transport protocol and port combination must be permitted through the firewall to allow these zone transfers to succeed?

  1. TCP port 53Cevap
  2. B
    UDP port 53
  3. C
    TCP port 389
  4. D
    UDP port 67

Cevap

TCP port 53
DNS relies on both UDP and TCP on port 53 depending on the nature of the request. Standard client name lookups use UDP port 53 because of low overhead and small packet sizes. However, zone transfers between primary and secondary DNS servers transmit significant volumes of record data that exceed UDP buffer limits and require guaranteed, ordered delivery. Therefore, TCP port 53 must be explicitly permitted through firewalls for secondary server synchronization.

Adım Adım Çözüm

1
Analyze the service requirements for standard DNS queries versus DNS zone transfers.
Standard DNS lookups use UDP port 53 for speed, whereas DNS zone replication (AXFR/IXFR) transfers entire database structures requiring reliability and larger data sizes.
Traditional UDP DNS responses are limited to 512 bytes (without EDNS0 extensions). Database synchronization payloads exceed this limit and require TCP stream guarantees.
2
Identify the correct protocol and port for DNS zone transfers.
DNS zone replication requires TCP port 53 to be open on firewalls between authoritative name servers.
TCP handles session establishment, sequencing, and error recovery for complete directory payload transfers between primary and secondary servers.

Anahtar Kavram

DNS Protocol Transport Selection (TCP vs UDP Port 53)
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Common Ports and Protocols

Bu konudan daha fazla soru