N10-009 Question 234
Single answerZone types: Forward, Reverse, Authoritative vs. non-authoritative, Primary vs. secondary, Recursive, Hosts fileA network administrator is troubleshooting name resolution for an internal application server named app01.corp.local. Users can reach the server by name, but security tools that perform lookups from IP address to hostname are failing. The administrator verifies that the A record for app01.corp.local exists and resolves correctly on the internal DNS server. Which action should the administrator take to fix the problem with the LEAST impact to the existing DNS design?
- A
Create a PTR record for the server in the appropriate reverse lookup zone
- B
Create a secondary forward lookup zone on the DNS server
- C
Add an entry for the server to the hosts file on every client workstation
- D
Enable recursion on the authoritative DNS server for the corp.local zone
Show answer and explanation
Correct answer: A
Explanation
This scenario distinguishes forward and reverse DNS zones in a practical troubleshooting context. The existing A record proves that forward resolution is functioning. When a tool needs to resolve an IP address back to a hostname, DNS uses a reverse lookup zone with PTR records, commonly under in-addr.arpa for IPv4. The best practice is to create and maintain matching forward and reverse records for managed systems, especially servers that are monitored, logged, or authenticated by security platforms. A secondary zone is useful for fault tolerance but does not replace missing records. A hosts file is a local override mechanism and is not a substitute for centrally managed DNS, especially for reverse lookups. Recursion is related to how a resolver obtains answers from other DNS servers and is unrelated to missing authoritative data in a local zone. This aligns with standard DNS operational guidance from Microsoft DNS documentation and general DNS behavior defined in IETF DNS standards such as RFC 1034 and RFC 1035.
- A. Correct.
Correct. Forward lookups resolve hostnames to IP addresses using records such as A or AAAA records, while reverse lookups resolve IP addresses back to hostnames using PTR records stored in a reverse lookup zone. Since users can already resolve app01.corp.local by name, the forward lookup path is working. The missing functionality is IP-to-name resolution, so adding the appropriate PTR record in the reverse zone is the most direct and least disruptive fix.
- B. Incorrect.
Incorrect. A secondary zone is a read-only copy of an existing zone used for redundancy and load distribution. It does not address the absence of reverse lookup data by itself. If the problem is specifically that IP address lookups are failing, the administrator needs a reverse lookup zone and PTR record, not another copy of the forward zone.
- C. Incorrect.
Incorrect. A hosts file maps hostnames to IP addresses locally on a device, but it does not provide standard reverse DNS functionality for centralized tools performing PTR-based lookups. It would also require manual updates on every workstation, which is not scalable and does not solve the DNS server-side reverse resolution issue.
- D. Incorrect.
Incorrect. Recursion allows a DNS server to query other DNS servers on behalf of a client when it is not authoritative for the requested name. In this scenario, the issue is not finding an external answer; it is that the internal DNS data needed for reverse resolution is missing. Enabling recursion would not create or replace the required PTR record.