mediumMultiple Choice
220-1201 Practice Question: A small office reports that internal users can…
A small office reports that internal users can access the internet but cannot resolve domain names to IP addresses. The DNS server is configured correctly. Which port should be checked on the firewall?
⚠ Common exam trap
The CompTIA A+ exam often tests the misconception that DNS uses only TCP or that port 80/443 are involved in name resolution, leading candidates to overlook the specific UDP port 53 requirement for DNS queries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Port 53
Port 53 is the standard port for DNS traffic, used for both TCP and UDP. Since internal users can access the internet but cannot resolve domain names, the firewall is likely blocking outbound DNS queries on port 53, preventing the client from reaching the DNS server even though the server itself is configured correctly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Port 80
Why it's wrong here
Port 80 carries unencrypted HTTP web traffic. Users can already reach internet sites, so this port is evidently passing traffic and is not the cause of failed name resolution. Port 80 matters when troubleshooting web access, not DNS queries.
- ✓
Port 53
Why this is correct
DNS queries and responses travel over port 53, so a firewall blocking that port prevents clients from resolving names even though the DNS server itself is correctly configured. Internet access over ports 80 and 443 still works, matching the reported symptoms.
- ✗
Port 443
Why it's wrong here
Port 443 carries HTTPS web traffic. Since internal users browse the internet successfully, this port is functioning and cannot explain the resolution failure. Port 443 is the one to verify when secure web access, not DNS lookup, is broken.
- ✗
Port 67
Why it's wrong here
Port 67 carries DHCP server traffic, used when clients obtain IP addresses, subnet masks and default gateways. Internal users already reach the internet, so addressing works and DHCP is not the failing service. Check port 67 only when clients cannot lease addresses at all.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 871 original 220-1201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1201 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1201 exam.