nerdexam
EC-Council

312-50V11 · Question #372

Employees in a company are no longer able to access Internet web sites on their computers. The network administrator is able to successfully ping IP address of web servers on the Internet and is able

The correct answer is A. Configure the firewall to allow traffic on TCP ports 53 and UDP port 53.. When websites are accessible by IP but not by URL, DNS resolution is broken, and the fix is to allow both UDP port 53 and TCP port 53 through the firewall.

Scanning Networks

Question

Employees in a company are no longer able to access Internet web sites on their computers. The network administrator is able to successfully ping IP address of web servers on the Internet and is able to open web sites by using an IP address in place of the URL. The administrator runs the response from the server. What should the administrator do next?

Options

  • AConfigure the firewall to allow traffic on TCP ports 53 and UDP port 53.
  • BConfigure the firewall to allow traffic on TCP ports 80 and UDP port 443.
  • CConfigure the firewall to allow traffic on TCP port 53.
  • DConfigure the firewall to allow traffic on TCP port 8080.

How the community answered

(26 responses)
  • A
    73% (19)
  • B
    15% (4)
  • C
    8% (2)
  • D
    4% (1)

Why each option

When websites are accessible by IP but not by URL, DNS resolution is broken, and the fix is to allow both UDP port 53 and TCP port 53 through the firewall.

AConfigure the firewall to allow traffic on TCP ports 53 and UDP port 53.Correct

DNS queries are sent over UDP port 53 by default for standard lookups, but fall back to TCP port 53 when responses exceed 512 bytes or for zone transfers. Allowing only one protocol would leave DNS partially broken, so both TCP port 53 and UDP port 53 must be opened on the firewall to ensure full DNS functionality and allow browsers to resolve hostnames to IP addresses.

BConfigure the firewall to allow traffic on TCP ports 80 and UDP port 443.

TCP port 80 is HTTP and UDP port 443 is QUIC/HTTP3; opening these would not restore DNS name resolution since the problem is upstream name lookup, not web traffic delivery.

CConfigure the firewall to allow traffic on TCP port 53.

Allowing only TCP port 53 is insufficient because DNS primarily uses UDP port 53 for queries, so most resolution requests would still be blocked without the UDP rule.

DConfigure the firewall to allow traffic on TCP port 8080.

TCP port 8080 is an alternate HTTP port used by some proxies and web servers and has no role in DNS name resolution.

Concept tested: DNS firewall port requirements TCP and UDP 53

Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/dns-works-on-tcp-and-udp

Topics

#DNS resolution#firewall rules#port 53#network troubleshooting

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V11 Practice