An administrator is unable to connect to servers in the DMZ. Which of the following commands should the administrator run to determine where the connection failure occurs?

nslookup queries DNS servers to resolve hostnames and would only help diagnose name resolution failures, not routing or connectivity failures.

Traceroute sends packets with incrementing TTL values to map every router hop between the source and destination, reporting latency and reachability at each step. An administrator can observe exactly which hop drops or delays packets, isolating whether the failure is at the firewall, a router, or within the DMZ segment itself. This makes it the ideal diagnostic tool for path-level connectivity failures.

Telnet tests whether a specific TCP port on a target host is reachable but does not reveal where along the path a connection is being blocked.

Netstat displays active connections and listening ports on the local machine and provides no information about remote path failures.