CAS-001 · Question #56
A small company has recently placed a newly installed DNS server on the DMZ and wants to secure it by allowing Internet hosts to query the DNS server. Since the company deploys an internal DNS…
The correct answer is A. Modify the SRC and DST ports of ACL 1. DNS operates on port 53 for both UDP and TCP. When an Internet host sends a DNS query, the destination port is 53 (the DNS server's listening port), but the source port is an ephemeral/high port (1024–65535) chosen by the client. Similarly, DNS responses flow back to the…
Question
A small company has recently placed a newly installed DNS server on the DMZ and wants to secure it by allowing Internet hosts to query the DNS server. Since the company deploys an internal DNS server, all DNS queries to that server coming from the company network should be blocked. An IT administrator has placed the following ACL on the company firewall:
Testing shows that the DNS server in the DMZ is not working. Which of the following should the administrator do to resolve the problem?
Options
- AModify the SRC and DST ports of ACL 1
- BModify the SRC IP of ACL 1 to 0.0.0.0/32
- CModify the ACTION of ACL 2 to Permit
- DModify the PROTO of ACL 1 to TCP
How the community answered
(42 responses)- A81% (34)
- B7% (3)
- C10% (4)
- D2% (1)
Explanation
DNS operates on port 53 for both UDP and TCP. When an Internet host sends a DNS query, the destination port is 53 (the DNS server's listening port), but the source port is an ephemeral/high port (1024–65535) chosen by the client. Similarly, DNS responses flow back to the client's ephemeral source port. If ACL 1 is configured with the source and destination ports transposed (e.g., SRC=53, DST=high, when it should be SRC=high, DST=53 for inbound queries), DNS traffic will be dropped. Modifying the SRC and DST ports of ACL 1 corrects the port direction for legitimate DNS query/response flows. The other options - changing the source IP to 0.0.0.0/32, permitting ACL 2's action, or changing the protocol to TCP - do not address the port mismatch that is causing inbound DNS queries to fail.
Topics
Community Discussion
No community discussion yet for this question.