LPIC-2 DNS, Web and Mail Services Practice Question
A company runs a DNS server using BIND9 on a Linux server. The server is configured with two network interfaces: one internal (192.168.1.10) and one external (203.0.113.10). The server is configured to be authoritative for example.com. Internal clients can resolve example.com, but external clients receive "SERVFAIL" responses. The host command from an external client returns "Host not found". The administrator checks the named configuration and finds the following in /etc/bind/named.conf.options:
options { directory "/var/cache/bind"; listen-on { 127.0.0.1; 192.168.1.10; 203.0.113.10; }; allow-query { 192.168.1.0/24; }; recursion no; dnssec-validation auto;
};
The zone configuration for example.com has proper allow-transfer and allow-update settings. What change should be made to resolve external queries?
⚠ Common exam trap
A common mix-up: candidates confuse 'allow-query' with 'listen-on' or 'recursion', assuming the issue is about network binding or recursive resolution rather than the explicit query access control list.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change 'allow-query' to '{ any; };'
The 'allow-query' directive restricts which clients can send queries to the server. With 'allow-query { 192.168.1.0/24; };', only internal clients on that subnet are permitted to query, causing external clients to receive SERVFAIL. Changing it to '{ any; };' allows all clients to query the server, resolving the issue while still keeping recursion disabled for security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add 'recursion yes;' to the options block.
Why it's wrong here
Recursion is not needed; the server is authoritative for the zone.
- ✗
Add 'listen-on port 53 { 203.0.113.10; };' to the options block.
Why it's wrong here
The listen-on already includes the external IP, so this is not needed.
- ✓
Change 'allow-query' to '{ any; };'
Why this is correct
Allows queries from any IP, fixing the external resolution.
- ✗
Change 'listen-on' to '{ any; };'
Why it's wrong here
listen-on already covers all necessary IPs; changing to any is unnecessary and less secure.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every LPIC-2 question from scratch — 507 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.