Which of the following firewall rules only denies DNS zone transfers?

The correct answer is C. deny tcp any any port 53. DNS uses two transport protocols for different purposes: UDP port 53 for standard DNS queries (fast, low-overhead lookups) and TCP port 53 for zone transfers (AXFR/IXFR), which transfer the full DNS zone database between servers. Zone transfers require TCP because they involve…

Security architecture

Question

Options

Adeny udp any any port 53
Bdeny ip any any
Cdeny tcp any any port 53
Ddeny all dns packets

How the community answered

(19 responses)

A
11% (2)
B
5% (1)
C
79% (15)
D
5% (1)

Explanation

DNS uses two transport protocols for different purposes: UDP port 53 for standard DNS queries (fast, low-overhead lookups) and TCP port 53 for zone transfers (AXFR/IXFR), which transfer the full DNS zone database between servers. Zone transfers require TCP because they involve large data payloads that exceed UDP's limitations. Denying TCP port 53 (C) blocks only zone transfers while allowing normal UDP-based DNS queries to continue. Denying UDP port 53 (A) would block normal DNS resolution but leave zone transfers intact - the opposite of the goal. Denying all IP traffic (B) would block everything, not just DNS. Denying all DNS packets (D) is not a valid standard firewall rule syntax and would block both UDP queries and zone transfers.

Topics

#DNS zone transfer#firewall rules#TCP 53#DNS security

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice