nerdexam
EC-Council

312-50V9 · Question #148

Employees in a company are no longer able to access Internet web sites on their computers. The network administrator is able to successfully ping IP address of web servers on the Internet and is able

The correct answer is A. Configure the firewall to allow traffic on TCP ports 53 and UDP port 53.. When users can access sites by IP but not by URL, DNS resolution is failing, requiring both UDP port 53 and TCP port 53 to be open on the firewall.

Scanning Networks

Question

Employees in a company are no longer able to access Internet web sites on their computers. The network administrator is able to successfully ping IP address of web servers on the Internet and is able to open web sites by using an IP address in place of the URL. The administrator runs the response from the server. What should the administrator do next?

Options

  • AConfigure the firewall to allow traffic on TCP ports 53 and UDP port 53.
  • BConfigure the firewall to allow traffic on TCP ports 80 and UDP port 443.
  • CConfigure the firewall to allow traffic on TCP port 53.
  • DConfigure the firewall to allow traffic on TCP port 8080.

How the community answered

(21 responses)
  • A
    81% (17)
  • B
    5% (1)
  • C
    10% (2)
  • D
    5% (1)

Why each option

When users can access sites by IP but not by URL, DNS resolution is failing, requiring both UDP port 53 and TCP port 53 to be open on the firewall.

AConfigure the firewall to allow traffic on TCP ports 53 and UDP port 53.Correct

DNS uses UDP port 53 for standard queries and TCP port 53 for responses exceeding 512 bytes as well as zone transfers. Allowing both protocols on port 53 restores full DNS resolution. Because the admin can already reach servers by IP, the web ports themselves are open - only name resolution is blocked.

BConfigure the firewall to allow traffic on TCP ports 80 and UDP port 443.

TCP port 80 (HTTP) and UDP port 443 are unrelated to DNS; HTTPS uses TCP 443, not UDP 443, and web traffic is already reachable by IP address.

CConfigure the firewall to allow traffic on TCP port 53.

Allowing only TCP port 53 is insufficient because standard DNS lookups use UDP port 53 as the primary transport, so most queries would still fail.

DConfigure the firewall to allow traffic on TCP port 8080.

TCP port 8080 is an alternate HTTP proxy port and has no role in DNS name resolution.

Concept tested: DNS port requirements and firewall configuration

Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/dns-works-on-tcp-and-udp

Topics

#DNS resolution#firewall rules#TCP/UDP port 53#network troubleshooting

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V9 Practice