LPIC-2 DNS, Web and Mail Services Practice Question
A DNS server returns SERVFAIL for queries to a zone that is configured as a slave. The master server is reachable. What should the administrator check?
⚠ Common exam trap
The trap here is that candidates often focus on serial numbers or query permissions, but the critical missing piece is the master's transfer authorization, which is a separate ACL from query access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The zone transfer is allowed from the slave.
When a slave DNS server returns SERVFAIL for a zone it is configured to serve, but the master is reachable, the most common cause is that the master's zone transfer ACL does not include the slave's IP address. Without an explicit 'allow-transfer' directive (or equivalent) on the master permitting the slave, the master will refuse the zone transfer, leaving the slave with no valid zone data and thus returning SERVFAIL. This is a fundamental access control check in BIND and other DNS servers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The serial number on the master is greater than on the slave.
Why it's wrong here
Serial number comparison is used to decide whether to transfer, but if transfer fails, the slave may have an old zone and return SERVFAIL, but the root cause is often access control.
- ✓
The zone transfer is allowed from the slave.
Why this is correct
If the master does not allow-transfer from the slave IP, the slave cannot obtain the zone and returns SERVFAIL.
- ✗
The slave's allow-query includes the master.
Why it's wrong here
allow-query is for client queries, not for zone transfers.
- ✗
The TSIG key is correct.
Why it's wrong here
TSIG is for authentication; if incorrect, it would cause a transfer error, but SERVFAIL can still occur from other issues.
Visual reference
Go deeper
Related to this question
About these practice questions
This LPIC-2 question is part of Courseiva's 507-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.