nerdexam
EC-Council

312-50V9 · Question #539

Which of the following statements about a zone transfer correct?(Choose three.

The correct answer is A. A zone transfer is accomplished with the DNS C. A zone transfer passes all zone information that a DNS server maintains E. A zone transfer can be prevented by blocking all inbound TCP port 53 connections. Zone transfers are a DNS protocol function that replicates all zone records from primary to secondary servers over TCP port 53, and can be restricted by blocking inbound TCP port 53.

Footprinting and Reconnaissance

Question

Which of the following statements about a zone transfer correct?(Choose three.

Options

  • AA zone transfer is accomplished with the DNS
  • BA zone transfer is accomplished with the nslookup service
  • CA zone transfer passes all zone information that a DNS server maintains
  • DA zone transfer passes all zone information that a nslookup server maintains
  • EA zone transfer can be prevented by blocking all inbound TCP port 53 connections
  • FZone transfers cannot occur on the Internet

How the community answered

(22 responses)
  • A
    77% (17)
  • B
    14% (3)
  • D
    5% (1)
  • F
    5% (1)

Why each option

Zone transfers are a DNS protocol function that replicates all zone records from primary to secondary servers over TCP port 53, and can be restricted by blocking inbound TCP port 53.

AA zone transfer is accomplished with the DNSCorrect

Zone transfers are a defined function of the DNS protocol (AXFR/IXFR), specified in RFC 5936, where a secondary DNS server requests a complete copy of zone data from the authoritative primary DNS server.

BA zone transfer is accomplished with the nslookup service

nslookup is a command-line DNS query utility; it is not a service that performs or facilitates zone transfers, which are handled by the DNS server process itself.

CA zone transfer passes all zone information that a DNS server maintainsCorrect

A full zone transfer (AXFR) copies all resource records maintained in the zone - including A, MX, NS, CNAME, SOA, and other record types - from the primary to the requesting secondary server.

DA zone transfer passes all zone information that a nslookup server maintains

nslookup does not maintain zone information - DNS servers maintain and serve zone data, while nslookup is only a client-side lookup tool.

EA zone transfer can be prevented by blocking all inbound TCP port 53 connectionsCorrect

Zone transfers require TCP port 53 rather than the UDP port 53 used for standard DNS queries, so blocking all inbound TCP port 53 connections effectively prevents unauthorized zone transfers from occurring.

FZone transfers cannot occur on the Internet

Zone transfers can and do occur on the Internet between authoritative DNS servers, though unrestricted zone transfers are a known security risk that can expose full DNS infrastructure details.

Concept tested: DNS zone transfer mechanics and TCP port restriction

Source: https://www.rfc-editor.org/rfc/rfc5936

Topics

#zone transfer#DNS security#TCP port 53#DNS enumeration

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V9 Practice