nerdexam
EC-Council

312-50V11 · Question #99

Which of the following statements about a zone transfer correct? (Choose three.)

The correct answer is A. A zone transfer is accomplished with the DNS C. A zone transfer passes all zone information that a DNS server maintains E. A zone transfer can be prevented by blocking all inbound TCP port 53 connections. DNS zone transfers replicate all DNS zone records from a primary to a secondary server using TCP port 53, and can be restricted by blocking inbound TCP port 53 connections.

Footprinting and Reconnaissance

Question

Which of the following statements about a zone transfer correct? (Choose three.)

Options

  • AA zone transfer is accomplished with the DNS
  • BA zone transfer is accomplished with the nslookup service
  • CA zone transfer passes all zone information that a DNS server maintains
  • DA zone transfer passes all zone information that a nslookup server maintains
  • EA zone transfer can be prevented by blocking all inbound TCP port 53 connections
  • FZone transfers cannot occur on the Internet

How the community answered

(53 responses)
  • A
    92% (49)
  • B
    4% (2)
  • D
    2% (1)
  • F
    2% (1)

Why each option

DNS zone transfers replicate all DNS zone records from a primary to a secondary server using TCP port 53, and can be restricted by blocking inbound TCP port 53 connections.

AA zone transfer is accomplished with the DNSCorrect

Zone transfers are a DNS protocol feature defined in RFC 5936, where a secondary DNS server requests a complete copy of a DNS zone from the primary server using the AXFR or IXFR query type over the DNS protocol.

BA zone transfer is accomplished with the nslookup service

nslookup is a client-side command-line query tool for DNS lookups; it does not define or perform zone transfers as a service - zone transfers are a server-to-server DNS protocol operation.

CA zone transfer passes all zone information that a DNS server maintainsCorrect

A zone transfer passes all resource records maintained in a DNS zone - including A, MX, NS, CNAME, SOA, and other record types - giving the requesting server a full replica of the zone data.

DA zone transfer passes all zone information that a nslookup server maintains

There is no such entity as an 'nslookup server'; nslookup is a diagnostic client utility, and zone transfers involve communication between DNS servers, not nslookup processes.

EA zone transfer can be prevented by blocking all inbound TCP port 53 connectionsCorrect

Zone transfers exclusively use TCP port 53 (unlike regular DNS queries which use UDP port 53), so blocking inbound TCP port 53 connections at a firewall effectively prevents unauthorized zone transfer requests from external hosts.

FZone transfers cannot occur on the Internet

Zone transfers can and do occur over the Internet between authoritative DNS servers, which is precisely why restricting TCP port 53 access is a recommended security measure to prevent unauthorized transfers to external parties.

Concept tested: DNS zone transfer mechanics and TCP port 53 security

Source: https://datatracker.ietf.org/doc/html/rfc5936

Topics

#DNS zone transfer#DNS enumeration#TCP port 53#DNS security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V11 Practice