Ordinary name lookups from a hotel PC are connectionless. Which port and transport should the firewall allow for those lookups?
Select an answer to reveal the explanation.
Short Explanation
A quick name lookup is a postcard, not a phone call that stays open. Connectionless lookups use UDP, and the DNS port is 53. The connection-oriented port 53, the DHCP port, and the encrypted web port serve a different request than the one you were given.
Full Explanation
Ordinary DNS queries use UDP port 53. The stem asks for the connectionless lookups, so the firewall rule that matches is UDP 53. TCP port 53 is still DNS, and it is the connection-oriented transport used for work such as large responses and zone transfers. It is not the connectionless case. UDP port 67 is a DHCP server port. It hands out addresses. It does not resolve a name lookup. TCP port 443 is HTTPS. It carries encrypted web sessions, which are connection-oriented and are not name lookups. Exam caveat: a resolver sometimes retries a lookup on TCP 53 when the answer is too large for one UDP message. The ordinary query the stem describes is still UDP 53. Operational check: allow UDP 53 to the resolver, look up a name from the hotel PC, and confirm the query is not sent to port 67 or 443. From the hotel PC, resolve a name and confirm the firewall log shows UDP 53, not the DHCP or web port. Repeat the lookup with the UDP 53 rule disabled and confirm the name then fails. Check the firewall log for UDP 53 on the test lookup.