A regional hospital runs IPv6-only tablets on new wards that must reach an IPv4-only patient records server the vendor will not upgrade, DNS is centrally managed, and dual-stack on the endpoints is prohibited by security policy. Which IPv4/IPv6 translation approach fits these boundary constraints?
Select an answer to reveal the explanation.
Short Explanation
You've got IPv6-only talkers and an IPv4-only listener, so you need a translator at the door. DNS64 hands the tablet a synthetic address while NAT64 bridges the gap, like a bilingual receptionist. That's the classic fit when upgrades aren't possible.
Full Explanation
Stateful NAT64 with DNS64 is designed for IPv6-only initiators reaching IPv4-only destinations without changing endpoints or servers, so the DNS64 synthesizes AAAA records from A records and NAT64 translates headers and embeds IPv4 state at the boundary, which matches centralized DNS control and the no-dual-stack constraint. Dual-stack on the core with tunnels fails by concept because it requires both protocols on hosts or path support and does not solve IPv4-only server reachability for IPv6-only clients without translation. Automatic 6to4 tunneling fails by concept because it provides IPv6 connectivity over IPv4 for dual-capable sites and does not translate between address families for application reachability. NAT46 at the access fails by concept because it is oriented to IPv4 initiators reaching IPv6 resources and inverts the required direction and scaling point, placing state in the wrong place. For the exam, remember translation is a boundary strategy of last resort when one side cannot be upgraded, not a replacement for planned dual-stack. In practice verify DNS64 synthesis prefix, NAT64 state limits, and application compatibility with translated addresses.