GIAC
GCIH · Question #598
As an incident handler, you are checking DNS server logs for DNS transfers. What protocol and port might indicate a zone transfer?
The correct answer is A. TCP port 53. To identify zone transfers, look for packets going to and from TCP port 53 on your DNS servers. Normal DNS queries and responses use UDP port 53. Zone transfers use TCP port 53, a tell-tale
Reconnaissance, Scanning, and Enumeration
Question
As an incident handler, you are checking DNS server logs for DNS transfers. What protocol and port might indicate a zone transfer?
Options
- ATCP port 53
- BUDP port 53
- CTCP port 25
- DUDP port 25
How the community answered
(36 responses)- A94% (34)
- B3% (1)
- D3% (1)
Explanation
To identify zone transfers, look for packets going to and from TCP port 53 on your DNS servers. Normal DNS queries and responses use UDP port 53. Zone transfers use TCP port 53, a tell-tale
Topics
#DNS zone transfer#TCP port 53#DNS reconnaissance#AXFR request
Community Discussion
No community discussion yet for this question.