Examkin

Soru

Zorluk: ZorFirewalls and Access Control Lists (ACLs)

A network administrator is troubleshooting connectivity issues on a router filtering traffic between client workstations on subnet 172.16.20.0/24172.16.20.0/24 and an internal core server on host 10.10.1.5/3210.10.1.5/32. Workstations are unable to resolve domain names using the internal DNS service hosted on 10.10.1.510.10.1.5. The administrator inspects the following IPv4 extended Access Control List (ACL) applied inbound on the workstation interface:

`10 permit tcp 172.16.20.0 0.0.0.255 host 10.10.1.5 eq 53`
`20 permit tcp 172.16.20.0 0.0.0.255 host 10.10.1.5 eq 88`
`30 permit tcp 172.16.20.0 0.0.0.255 host 10.10.1.5 eq 445`

Which of the following best explains why standard DNS queries sent by client workstations to the server are being dropped?

  1. Standard client DNS lookups primarily use UDP port 53, but rule 10 only permits TCP port 53, causing UDP queries to fall through to the implicit deny rule.Cevap
  2. B
    Standard client DNS lookups exclusively use TCP port 53, but stateless ACLs cannot inspect TCP headers without Port Address Translation (PAT) enabled.
  3. C
    DNS resolution services use destination port 5353 by default, making port 53 in rule 10 an incorrect port assignment for domain name resolution.
  4. D
    Because an explicit deny rule was omitted after line 30, the router defaults to forwarding all traffic without evaluating lines 10 through 30.

Cevap

Standard client DNS lookups primarily use UDP port 53, but rule 10 only permits TCP port 53, causing UDP queries to fall through to the implicit deny rule.
Standard DNS client queries use UDP port 53 for fast, connectionless name lookups. Rule 10 specifies protocol `tcp`, which does not match UDP packets. Unmatched UDP DNS queries pass through lines 10, 20, and 30 without matching, hitting the ACL's mandatory implicit deny rule at the bottom and getting dropped.

Adım Adım Çözüm

1
Analyze the protocol requirement for standard DNS queries.
Standard client-to-server DNS name resolution requests are sent using UDP datagrams to port 53 (TCP port 53 is reserved for zone transfers or responses exceeding 512 bytes).
Identifying the transport-layer protocol used by standard DNS client software is necessary to evaluate ACL rule parameters.
2
Evaluate the configured ACL entries against client DNS traffic.
Line 10 permits `tcp` port 53 traffic from `172.16.20.0/24` to `10.10.1.5`. Incoming UDP packets targeting port 53 do not match the protocol field (`tcp`) of line 10.
ACL rules evaluate packets sequentially and require exact matches for configured fields (protocol, source, destination, port).
3
Determine packet disposition for unmatched traffic.
The incoming UDP packets fail to match lines 10, 20, and 30, reaching the end of the access control list where they are dropped by the implicit `deny ip any any` rule.
Every network ACL ends with an invisible default action that blocks all traffic not explicitly permitted.

Anahtar Kavram

Stateless ACL matching rules, transport layer protocol distinctions (TCP vs UDP for DNS), and the implicit deny behavior.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Firewalls and Access Control Lists (ACLs)

Bu konudan daha fazla soru