nerdexam
EC-Council

312-50V10 · Question #99

Which of the following statements about a zone transfer correct? (Choose three.)

The correct answer is A. A zone transfer is accomplished with the DNS C. A zone transfer passes all zone information that a DNS server maintains E. A zone transfer can be prevented by blocking all inbound TCP port 53 connections. Zone transfers are a DNS function using TCP port 53 to replicate entire zone datasets between servers, and can be blocked by restricting inbound TCP port 53 connections.

Footprinting and Reconnaissance

Question

Which of the following statements about a zone transfer correct? (Choose three.)

Options

  • AA zone transfer is accomplished with the DNS
  • BA zone transfer is accomplished with the nslookup service
  • CA zone transfer passes all zone information that a DNS server maintains
  • DA zone transfer passes all zone information that a nslookup server maintains
  • EA zone transfer can be prevented by blocking all inbound TCP port 53 connections
  • FZone transfers cannot occur on the Internet

How the community answered

(21 responses)
  • A
    95% (20)
  • B
    5% (1)

Why each option

Zone transfers are a DNS function using TCP port 53 to replicate entire zone datasets between servers, and can be blocked by restricting inbound TCP port 53 connections.

AA zone transfer is accomplished with the DNSCorrect

Zone transfers are a native DNS operation where a secondary name server requests a full copy of a zone from the primary DNS server using the DNS protocol. The transfer is handled entirely within the DNS infrastructure, not by any external service.

BA zone transfer is accomplished with the nslookup service

nslookup is a command-line diagnostic utility for querying DNS records interactively; it does not perform or facilitate zone transfers between DNS servers.

CA zone transfer passes all zone information that a DNS server maintainsCorrect

A zone transfer replicates the complete contents of a zone file, including every resource record type such as A, MX, NS, SOA, and CNAME entries. This full replication allows the secondary server to answer authoritatively for the entire zone.

DA zone transfer passes all zone information that a nslookup server maintains

nslookup does not store or maintain zone information of any kind; it is a client-side lookup tool, not a DNS server component.

EA zone transfer can be prevented by blocking all inbound TCP port 53 connectionsCorrect

Zone transfers use TCP port 53 rather than UDP because the large size of zone datasets requires the reliable, ordered byte-stream delivery that TCP provides. Blocking inbound TCP port 53 connections prevents external hosts from initiating zone transfer requests against the server.

FZone transfers cannot occur on the Internet

Zone transfers do occur over the Internet between authoritative DNS servers; best practice restricts them to known secondary server IP addresses but they are not technically prohibited on the Internet.

Concept tested: DNS zone transfer mechanics and TCP port 53 security

Source: https://datatracker.ietf.org/doc/html/rfc5936

Topics

#DNS zone transfer#TCP port 53#DNS enumeration#reconnaissance

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V10 Practice