N10-009 Question 59
Single answerDNS: 53A company recently migrated its public website to a new hosting provider. Users report that they can reach the site by entering the server's public IP address in a browser, but they cannot reach it by using the website's fully qualified domain name (FQDN). A network technician verifies that web traffic on TCP 80 and 443 is allowed through the firewall and that the web server is online. Which of the following is the MOST likely cause of the issue?
- A
Port 53 traffic to the organization's DNS server is being blocked
- B
Port 67 traffic is not reaching the web server
- C
Port 123 is disabled on the edge firewall
- D
Port 389 access to the domain controller has failed
Show answer and explanation
Correct answer: A
Explanation
This scenario is a classic DNS troubleshooting case. The key clue is that the website is reachable by IP address but not by FQDN. That means Layer 3 connectivity and the web service itself are likely working, while name resolution is failing. DNS operates on port 53, using UDP for standard queries and TCP for larger responses, DNSSEC-related exchanges, and zone transfers. Network+ candidates should recognize that when a host is reachable by IP but not by name, DNS is the first service to investigate. This aligns with common troubleshooting practices and with standard DNS behavior documented by IANA service name assignments and DNS operational guidance in RFC 1034 and RFC 1035.
- A. Correct.
Correct. DNS uses port 53 (UDP for most queries and TCP for some responses and zone transfers). If users can access the site by IP address but not by FQDN, name resolution is the likely failure point. Blocking DNS traffic to the authoritative or recursive DNS server would prevent clients from resolving the website name to its IP address, even though the web service itself is functioning properly.
- B. Incorrect.
Incorrect. Port 67 is used by DHCP server services, not by web browsing or DNS name resolution. A DHCP issue could affect IP assignment for clients in some scenarios, but it would not specifically explain why users can reach the site by IP address yet fail when using the FQDN.
- C. Incorrect.
Incorrect. Port 123 is used by NTP for time synchronization. Time issues can affect some security services and authentication, but they do not directly cause the symptom where a website is reachable by IP address but not by name in a straightforward public web access scenario.
- D. Incorrect.
Incorrect. Port 389 is used by LDAP. Problems with LDAP or a domain controller may affect directory lookups or authentication in enterprise environments, but they do not typically prevent external users from resolving a public website name when direct IP connectivity to the web server is confirmed.