mediumMultiple ChoiceObjective-mapped
220-1201 Practice Question: A company's internal DNS server is not resolving…
A company's internal DNS server is not resolving hostnames for clients. The technician verifies that the DNS service is running and the firewall allows traffic on port 53. However, clients still cannot resolve names. What is the most likely issue?
⚠ Common exam trap
CompTIA often tests the misconception that DNS only uses UDP port 53, leading candidates to overlook the necessity of TCP port 53 for truncated responses and zone transfers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall is blocking TCP port 53
DNS uses both UDP and TCP on port 53. While initial queries typically use UDP, responses that are truncated (e.g., due to large DNSSEC records or many resource records) require TCP to complete the resolution. Since the technician verified that the firewall allows traffic on port 53 (likely only UDP) and the DNS service is running, the most likely issue is that the firewall is blocking TCP port 53, preventing the fallback TCP connection needed for successful name resolution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The firewall is blocking UDP port 53
Why it's wrong here
Standard DNS queries, which are typically small and connectionless, primarily utilize UDP port 53. If a firewall were blocking UDP port 53, clients would be unable to send initial DNS requests to the server, resulting in a complete failure to resolve any hostnames. This would manifest as an immediate and total inability to access resources by name, rather than the more nuanced issues that might arise from TCP port 53 being blocked.
- ✗
The DNS server is using port 5353 instead of 53
Why it's wrong here
Port 5353 is specifically designated for Multicast DNS (mDNS), which is a protocol used for local network service discovery without requiring a traditional DNS server. A standard internal DNS server, responsible for resolving hostnames for clients, must listen on the well-known UDP and TCP port 53. If the server were configured to use port 5353 instead, client requests sent to the standard port 53 would never reach the DNS service, preventing any hostname resolution.
- ✓
The firewall is blocking TCP port 53
Why this is correct
While most initial DNS queries use UDP port 53, TCP port 53 is essential for specific DNS operations, particularly zone transfers between DNS servers and for DNS responses that exceed the typical 512-byte UDP packet limit. If a firewall blocks TCP port 53, clients might experience intermittent or complete hostname resolution failures when querying for large records (e.g., DNSSEC records, multiple SRV records) or when the DNS server needs to perform a zone transfer to update its own records, leading to stale or missing entries.
- ✗
Clients are using the wrong DNS server IP
Why it's wrong here
If clients were configured with the wrong DNS server IP address, they would be attempting to query a non-existent or incorrect server, leading to a complete failure in hostname resolution. While this is a common troubleshooting step, the problem statement focuses on the internal DNS server itself "not resolving hostnames," suggesting the issue lies with the server's operation or its network accessibility, rather than client misconfiguration pointing to a different server entirely.
Visual reference
Quick reference
Common DNS Record Types
| Record | Purpose | Example |
|---|---|---|
| A | IPv4 address mapping | example.com → 93.184.216.34 |
| AAAA | IPv6 address mapping | example.com → 2606:2800::1 |
| CNAME | Alias to another hostname | www → example.com |
| MX | Mail server for domain | example.com → mail.example.com (priority 10) |
| TXT | Text data (SPF, DKIM, verification) | v=spf1 include:_spf.example.com ~all |
| NS | Authoritative name servers | example.com NS ns1.example.com |
| PTR | Reverse DNS (IP → hostname) | 34.216.184.93.in-addr.arpa → example.com |
| SOA | Zone authority record | Primary NS, admin email, serial, TTL defaults |
Go deeper
Related to this question
Learn chapter
Internet Connection Types
Key term
TCP
TCP (Transmission Control Protocol) is a core internet protocol that ensures data is sent reliably and in order between devices over a network.
Key term
UDP
UDP (User Datagram Protocol) is a communication protocol that sends data quickly without first checking if the receiver is ready or if the data arrived correctly.
About these practice questions
This 220-1201 question is part of Courseiva's 972-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1201 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1201 exam.