Examkin

Soru

Zorluk: OrtaDNS Infrastructure and Record Types

A network administrator is deploying a secondary authoritative DNS server to provide redundancy for the domain `corp.example.com`. While standard client queries resolve properly across the internal network, full zone transfers between the primary server (`10.0.1.50`) and the secondary server (`10.0.2.50`) consistently fail. Executing `dig @10.0.1.50 corp.example.com AXFR` from the secondary server results in the following output:

text
;; Connection to 10.0.1.50#53(10.0.1.50) for corp.example.com failed: connection refused.

Standard single-record DNS queries using UDP port 53 succeed without issue. Which firewall modification will resolve the zone transfer failure?

  1. Permit traffic between the primary and secondary DNS servers on TCP port 53.Cevap
  2. B
    Permit traffic between the primary and secondary DNS servers on UDP port 53.
  3. C
    Permit traffic between the primary and secondary DNS servers on UDP port 5353.
  4. D
    Configure a CNAME record mapping the primary server IP address to the secondary server hostname.

Cevap

Permit traffic between the primary and secondary DNS servers on TCP port 53.
Allowing TCP port 53 enables the primary and secondary DNS servers to establish a reliable stream connection. DNS zone transfers (AXFR/IXFR) transport large volumes of resource records and require the reliability and packet ordering of TCP, whereas standard client resolution queries utilize UDP.

Adım Adım Çözüm

1
Analyze the diagnostic command and failure output
The command `dig @10.0.1.50 corp.example.com AXFR` tests an Authoritative Zone Transfer (AXFR). The output indicates a connection failure on port 53, even though UDP queries succeed.
Standard lookups use UDP port 53, whereas AXFR zone transfers require TCP port 53 due to data size and reliability requirements.
2
Identify transport protocol requirements for DNS operations
DNS uses UDP/53 for small, fast queries/responses, but requires TCP/53 for zone transfers (AXFR/IXFR) and responses exceeding standard buffer sizes.
TCP guarantees reliable delivery and stream control when synchronizing entire DNS zone files between primary and secondary name servers.
3
Select the appropriate firewall rule update
Allowing TCP port 53 traffic between `10.0.1.50` and `10.0.2.50` will permit successful zone synchronization.
Opening TCP port 53 solves the underlying transport block preventing AXFR requests from completing.

Anahtar Kavram

DNS Transport Protocols (UDP vs TCP Port 53) and Zone Transfers
Bu soruyu puanla

Konular

DNS Infrastructure and Record Types

Bu konudan daha fazla soru