N10-009 Question 83
Single answerSQL Server: 1433A company migrates its Microsoft SQL Server database to a new subnet behind an internal firewall. After the move, application servers can ping the database server by IP address, but the applications cannot connect to the database. The database team confirms the SQL Server service is running and configured to listen on its default port. Which firewall change should the network administrator make first to restore application connectivity while following standard SQL Server defaults?
- A
Allow inbound TCP 1433 from the application servers to the SQL Server
- B
Allow inbound UDP 1433 from the application servers to the SQL Server
- C
Allow inbound TCP 3389 from the application servers to the SQL Server
- D
Allow inbound UDP 53 from the application servers to the SQL Server
Show answer and explanation
Correct answer: A
Explanation
The key detail is that the SQL Server service is running and configured to use its default listening port. By default, Microsoft SQL Server listens for client connections on TCP 1433. In a segmented network, ICMP reachability such as ping does not prove that the required application port is allowed through the firewall. The correct first step is to permit TCP 1433 from the application tier to the SQL Server. This aligns with Microsoft documentation for the SQL Server Database Engine default port behavior and with standard firewall best practices of allowing only the required protocol and port between specific source and destination systems. UDP 1433 is not the default transport for SQL Server client connections, TCP 3389 is for remote administration, and UDP 53 is for DNS rather than database traffic.
- A. Correct.
Correct. Microsoft SQL Server uses TCP port 1433 by default for client connections to the database engine. If the SQL Server is configured to listen on its default port, the firewall must permit TCP 1433 from the application servers to the database server. This is the most direct and appropriate first change based on the scenario.
- B. Incorrect.
Incorrect. SQL Server client traffic to the database engine does not normally use UDP 1433. A common mistake is confusing the protocol or assuming the same port number works over either transport. SQL Server default database connections are TCP-based, not UDP-based.
- C. Incorrect.
Incorrect. TCP 3389 is used for Remote Desktop Protocol (RDP), which would allow remote administration of the server, not database application connectivity. Someone might choose this if they are thinking about server access in general rather than the specific port needed for SQL Server client sessions.
- D. Incorrect.
Incorrect. UDP 53 is used for DNS queries, not SQL Server database connections. DNS could matter if name resolution were failing, but the scenario states the server is reachable by IP and asks specifically about restoring SQL connectivity using standard SQL Server defaults.