A small company has recently placed a newly installed DNS server on the DMZ and wants to secure it by allowing Internet hosts to query the DNS server. Since the company deploys an internal DNS…

Question

Options

• AModify the SRC and DST ports of ACL 1
• BModify the SRC IP of ACL 1 to 0.0.0.0/32
• CModify the ACTION of ACL 2 to Permit
• DModify the PROTO of ACL 1 to TCP

• A
  63% (26)
• B
  5% (2)
• C
  12% (5)
• D
  20% (8)

Explanation

DNS uses UDP (and sometimes TCP) port 53. A DNS query originates from a client on a high ephemeral source port (e.g., 1024–65535) destined for port 53 on the DNS server. A DNS response comes from port 53 on the server back to the client's ephemeral port. If ACL 1 - which is meant to allow Internet hosts to query the DMZ DNS server - has the SRC and DST ports incorrectly configured (e.g., SRC=53 and DST=any, instead of SRC=any high port and DST=53), it will block incoming DNS queries rather than permitting them, causing the DNS server to appear non-functional from the Internet. Modifying the SRC and DST ports of ACL 1 (A) corrects this misconfiguration. Answer B (changing SRC IP to 0.0.0.0/32) is a /32 mask that matches only one specific IP, not all Internet hosts. Answer C (changing ACL 2 action to Permit) would allow blocked traffic that should remain blocked. Answer D (changing protocol to TCP) would break standard UDP-based DNS queries.

No community discussion yet for this question.