Examkin

Soru

Zorluk: Çok zorDNS Infrastructure and Record Types

An enterprise network administrator is auditing an organization's authoritative external DNS server configuration following a security compliance review. The audit requires configuring zone replication securely, ensuring proper transport protocol handling for large DNSSEC-signed payloads, and maintaining compliant email sender verification. During diagnostic testing, the administrator executes the following `dig` commands against the primary authoritative name server:

text
$ dig @ns1.example.com example.com AXFR
;; communications error to 192.0.2.10#53: end of file

$ dig @ns1.example.com example.com +dnssec +bufsize=4096
;; Truncation flag (TC) set; retrying over TCP...
;; Query time: 14 msec
;; SERVER: 192.0.2.10#53(192.0.2.10) (TCP)
;; MSG SIZE rcvd: 2840

Based on the diagnostic output and DNS architectural standards, which TWO of the following statements correctly identify the underlying transport requirements and resource record implementations for this environment?

  1. Full zone transfers (AXFR) and DNS queries whose responses exceed payload size limits require open TCP port 53 communications through firewalls between involved name servers and clients.Cevap
  2. B
    Domain Name System Security Extensions (DNSSEC) validation exclusively relies on UDP port 53, causing stub resolvers to drop any packet where the TC (Truncation) flag is set.
  3. Sender Policy Framework (SPF) records must be published as standard TXT records, as the dedicated SPF record type (Type 99) was deprecated by RFC 7208.Cevap
  4. D
    Mail exchanger (MX) record preference targets must point directly to a CNAME record to allow flexible canonical hostname redirection across remote web clusters.
  5. E
    Standard DNS resolution operates entirely on UDP port 53, so all TCP port 53 traffic should be blocked at the perimeter firewall to prevent unauthorized administrative terminal access.

Cevap

The two correct statements are: 1) Full zone transfers (AXFR) and DNS responses exceeding payload size limits require open TCP port 53 communications through firewalls, and 2) Sender Policy Framework (SPF) records must be published as standard TXT records due to the deprecation of the dedicated SPF record type.
The correct options accurately state DNS transport requirements and resource record standards. First, DNS uses TCP port 53 both for authoritative zone transfers (AXFR/IXFR) and as a fallback mechanism whenever a response exceeds payload size thresholds (indicated by the TC bit). Second, Sender Policy Framework (SPF) data must be configured within TXT resource records, as the standalone SPF record type (type 99) was officially deprecated.

Adım Adım Çözüm

1
Analyze the transport protocol behavior shown in the dig command outputs.
The first dig output demonstrates an attempted AXFR (zone transfer). Zone transfers depend on TCP port 53 to guarantee reliable transmission of the complete zone file. The second dig output highlights the Truncation flag (TC) being set on a large DNSSEC payload, prompting an automatic fallback from UDP to TCP port 53.
Understanding when DNS transitions from UDP to TCP is critical for firewall rule configuration and troubleshooting DNSSEC/zone replication.
2
Evaluate record type specifications for email security standards (SPF and MX).
Sender Policy Framework (SPF) legacy RR type 99 was deprecated under RFC 7208; SPF policies must now reside within standard TXT records. Additionally, MX records must point strictly to canonical host address records (A/AAAA) rather than CNAME aliases.
Proper record creation ensures compliant mail flow and validation without breaking RFC standards.

Anahtar Kavram

DNS Transport Protocols (UDP vs TCP 53), Zone Transfers (AXFR/IXFR), and Resource Record Specifications (TXT/SPF, MX, CNAME)
Bu soruyu puanla

Konular

DNS Infrastructure and Record Types

Bu konudan daha fazla soru