AP Networking DNS Resolution Practice Test

1. school.lab.example.
2. lab.example.school.
3. lab.school.example.
4. example.school.lab.

Correct answer: C. lab.school.example.

DNS labels run from the most specific name toward the root. The trailing dot explicitly marks an absolute name.

1. MX records for the zone alone
2. NS records for that zone
3. PTR records for every client
4. The client's configured recursive server option alone

Correct answer: B. NS records for that zone

NS records identify the zone's name servers. Their reachability and authoritative contents still need checking.

1. Ethernet MAC learning bridge
2. DHCP relay
3. Recursive caching resolver
4. Authoritative server for every queried Internet zone

Correct answer: C. Recursive caching resolver

Recursion and caching are resolver functions. A server is authoritative only for zones it actually serves.

1. Ownership of the client's DHCP assignment
2. Authority for the zone concerned
3. Permission to recurse for every client
4. Authority for all names the server has ever cached

Correct answer: B. Authority for the zone concerned

Authority has a zone boundary. It does not mean the server knows or controls every name in the hierarchy.

1. AAAA
2. MX
3. NS alone
4. PTR

Correct answer: B. MX

An MX record names a mail exchanger and includes preference. The exchanger's address and the mail service's reachability are separate requirements.

1. The record with preference 10
2. The record with the larger numeric address
3. The record with the longer hostname
4. The record with preference 30

Correct answer: A. The record with preference 10

Lower MX preference values are preferred. Delivery behavior also depends on reachable exchangers and the mail system's implementation.

1. CNAME at the gateway
2. PTR in the appropriate reverse zone
3. MX in the forward zone
4. TXT in the DHCP scope

Correct answer: B. PTR in the appropriate reverse zone

Reverse resolution uses PTR data under the reverse namespace. It is maintained separately from the forward address record.

1. Every active transport connection
2. Every client-side cached answer
3. Every current client lease
4. A zone's administrative and version-related information

Correct answer: D. A zone's administrative and version-related information

SOA data includes a serial and other zone parameters. It is not a substitute for client routing or transport-state information.

1. Another domain name
2. A transport port number
3. An IPv4 address stored in the alias field
4. A DHCP client identifier

Correct answer: A. Another domain name

A CNAME target is a name, whose relevant record data must then be resolved. It is not an address stored in the alias field.

1. The name is proven nonexistent
2. The zone is necessarily absent
3. The server declined that query under its policy
4. No DNS response arrived

Correct answer: C. The server declined that query under its policy

REFUSED is a received DNS result about processing policy. It differs from NXDOMAIN, SERVFAIL, and an unanswered query.

1. The client definitely has no valid address
2. Resolution failed at that resolver; the specific cause needs investigation
3. The queried name definitely does not exist
4. The server definitely rejected the query by policy

Correct answer: B. Resolution failed at that resolver; the specific cause needs investigation

SERVFAIL can have several causes, including upstream or validation problems. The response code alone does not locate the cause.

1. Both prove authoritative nonexistence
2. NXDOMAIN proves the responder was unreachable
3. Timeout proves a received negative answer
4. NXDOMAIN is a name-error response; timeout means no usable reply arrived within the test interval

Correct answer: D. NXDOMAIN is a name-error response; timeout means no usable reply arrived within the test interval

A received answer and missing answer require different investigations. Keep resolver, name, type, and time with each result.

1. A recursive referral
2. NODATA for that queried type
3. A completed IPv6 service connection
4. NXDOMAIN for the whole owner name

Correct answer: B. NODATA for that queried type

NODATA means the queried type is absent for the relevant existing name. It is distinct from a statement that the name does not exist.

1. The query type
2. The transaction ID alone
3. The response's record order
4. The resolver address alone

Correct answer: A. The query type

Name, type, and class define the question. Identical names queried for different types need not return equivalent answers.

1. Until every application connection ends
2. Until the lease expires
3. 120 minutes
4. Up to those remaining 120 seconds

Correct answer: D. Up to those remaining 120 seconds

TTL is a cache lifetime in seconds for DNS data. It does not govern leases or the duration of established application connections.

1. Remove authoritative records to limit transfer access
2. Allow any querying client to copy every zone
3. Treat recursive-client permission as transfer permission
4. Limit transfers to the intended recipients

Correct answer: D. Limit transfers to the intended recipients

Zone transfer access is a server-side administrative policy. A public lookup service need not expose full zone transfers to everyone.

1. PTR
2. SRV
3. A alone
4. AAAA alone

Correct answer: B. SRV

SRV data includes service location information such as target and port. The service and its addresses still require separate validation.

1. An automatic endpoint firewall rule
2. A replacement for every service port
3. Text data associated with its owner name
4. A command automatically executed by all resolvers

Correct answer: C. Text data associated with its owner name

Applications can give TXT content specific meaning. DNS storage alone does not make arbitrary text an executable network configuration.

1. PTR permanently identifies one human
2. PTR assigns an application role
3. Reverse names are DNS data, not user authentication
4. PTR alone verifies user identity

Correct answer: C. Reverse names are DNS data, not user authentication

A reverse name may help operations, but identity claims need the relevant authentication and trust checks.

1. The local entry publishes a public record
2. The entry updates the SOA serial automatically
3. Every application must use only DNS
4. Local name sources may override or differ from DNS results

Correct answer: D. Local name sources may override or differ from DNS results

Determine the name-resolution path the application actually uses. An explicit DNS test may not match a local override.

1. Only the cached answer for an unrelated name
2. Only the client-facing resolver address without forwarding scope
3. Only whether the server process runs
4. Which names or query classes use that forwarding path

Correct answer: D. Which names or query classes use that forwarding path

Forwarding policy introduces another dependency. Its scope matters when only some namespaces fail.

1. It bypasses transport policy
2. It removes ambiguity from search-list expansion
3. It clears every resolver cache
4. It guarantees the listener is running

Correct answer: B. It removes ambiguity from search-list expansion

An absolute name helps ensure different clients ask the same question. It does not validate the resulting address's service path.

1. Which returned address the application actually selected
2. Only the longest TTL
3. Only that one returned address responds
4. Only the first printed address regardless of selection

Correct answer: A. Which returned address the application actually selected

The selected destination determines the actual connection path. One successful returned address does not validate every alternative.

1. Only a statement that DNS worked
2. Exact name, type, resolver, response, and timestamp
3. Only the name without resolver or type
4. Only the returned address

Correct answer: B. Exact name, type, resolver, response, and timestamp

These fields make the lookup reviewable and distinguish answers from different views, caches, and times.

1. Authenticity and integrity of the validated DNS data chain
2. Confidentiality of every query
3. Correct application permissions
4. Unlimited service availability

Correct answer: A. Authenticity and integrity of the validated DNS data chain

DNSSEC validation concerns DNS data. It does not encrypt queries or prove that an application endpoint will accept the user.

1. 1440 seconds
2. 540 seconds
3. 900 seconds
4. 360 seconds

Correct answer: B. 540 seconds

Six minutes consume 360 seconds. The ordinary remaining lifetime is 900 minus 360, or 540 seconds.

1. Only the printer's transport listener
2. Resolver query policy and client/source scope
3. Only whether the name exists in any zone
4. Only whether resolver A answered quickly

Correct answer: B. Resolver query policy and client/source scope

The received refusal identifies policy at B rather than proving the name is absent. Compare authorized recursion, views, and query scope.

1. Whether forward and reverse data reflect the intended host identity
2. Whether DHCP always controls both zones
3. Whether the mismatch necessarily breaks TCP
4. Whether PTR automatically rewrites A

Correct answer: A. Whether forward and reverse data reflect the intended host identity

Forward and reverse namespaces are maintained independently. The mismatch may affect operational checks without proving transport failure.

1. A higher MX preference
2. Address resolution for the exchanger target
3. A PTR for every sender
4. A CNAME at the mail domain instead of usable target data

Correct answer: B. Address resolution for the exchanger target

The MX names a host; delivery then needs its address and reachable mail service. A correct MX owner alone is insufficient.

1. The intended alias target and its address data
2. Only the alias label while retaining the retired target
3. Only the resolver's reverse record
4. Only the terminal record's TTL without repairing the chain

Correct answer: A. The intended alias target and its address data

The alias chain ends at a missing dependency. Restore the intended target relationship rather than infer that all resolution is unavailable.

1. The namespace-specific forwarding dependency
2. Only the client's search list regardless of queried namespace
3. A universal failure of all resolution
4. Every public authoritative copy

Correct answer: A. The namespace-specific forwarding dependency

Selective namespace failure fits the forwarding rule's scope. Check the chosen upstream and policy/path for that set of names.

1. Whether disagreement alone proves compromise
2. Zone update distribution and the intended current data
3. Whether one client has a faster link
4. Whether serial values numerically equal host addresses

Correct answer: B. Zone update distribution and the intended current data

Inconsistent authoritative copies can create varying answers. Compare update/transfer state and intended data without inferring malicious activity from disagreement alone.

1. The MX preference
2. The reverse lookup suffix
3. The application's transport receive window
4. Its effective search suffix/list

Correct answer: D. Its effective search suffix/list

The expanded question differs from the intended name. Confirm the application's actual expansion and use an absolute-name control test.

1. The reachable server's local data necessarily
2. Only reverse resolution
3. Discovery of the intended authority through the delegation path
4. Every direct query to the reachable server

Correct answer: C. Discovery of the intended authority through the delegation path

A direct query can work while normal recursive discovery follows stale delegation. Inspect parent and child records separately.

1. Treat every NOERROR as a requested address answer
2. Delete the working A data
3. Distinguish missing queried type from NXDOMAIN
4. Create an unrelated PTR as a substitute

Correct answer: C. Distinguish missing queried type from NXDOMAIN

The query type determines what is missing. An existing IPv4-only name can legitimately lack an IPv6 address record.

1. Only a successful gateway ping
2. Only the count of aliases
3. Only the client's configured resolver address
4. The selected authority addresses and traffic to/from those addresses

Correct answer: D. The selected authority addresses and traffic to/from those addresses

Trace which servers were selected and their request/reply paths. A lookup failure can arise after correct delegation discovery.

1. Only the authoritative record already checked
2. Only the reverse namespace
3. Only the resolver's process status
4. Application caching, local overrides, connection reuse, and the effective resolver

Correct answer: D. Application caching, local overrides, connection reuse, and the effective resolver

The application's state can differ from a new diagnostic lookup. Determine its selected address before treating the fresh answer as proof of its behavior.

1. The owner name must be absent
2. All UDP replies require a TCP handshake
3. The SOA serial is too high
4. It does not match the request context

Correct answer: D. It does not match the request context

Clients associate replies with outstanding queries using request context. Receiving a DNS-shaped packet does not prove it is the usable response to this request.

1. No; its intended role may be authoritative-only for those clients
2. Yes, authoritative service proves recursive service
3. Yes, every server must recurse for every source
4. Only if reverse records exist

Correct answer: A. No; its intended role may be authoritative-only for those clients

Server role and access policy determine expected behavior. Verify the stated service rather than impose open recursion on an authoritative server.

1. Set TTL from the application's source port
2. Reducing it early enough for old longer-lived entries to age before the move
3. Lower TTL only after the old host shuts down
4. Expect all stored lifetimes to change immediately

Correct answer: B. Reducing it early enough for old longer-lived entries to age before the move

A new lower TTL affects later cache refreshes, not the remaining lifetime already stored elsewhere. Plan overlap and verify the clients' actual destinations.

1. Only server process status
2. Signature/delegation validation evidence and the intended trust chain
3. Only a passing small UDP query
4. Only the convenient nonvalidating result

Correct answer: B. Signature/delegation validation evidence and the intended trust chain

The difference may identify a validation problem. Investigate chain, signatures, timing, and authoritative data instead of removing assurance as the first repair.

1. The intended resolution path for that namespace
2. Only a successful unrelated public lookup
3. Only the web listener
4. Only the server's public reverse name

Correct answer: A. The intended resolution path for that namespace

The application may be asking a server without the intended internal view. Correct scope and permitted dependencies rather than publish private data automatically.

1. Only a working IPv4 connection
2. Only a local resolver ping
3. Test the intended service through each enabled returned family/address
4. Only a successful A lookup

Correct answer: C. Test the intended service through each enabled returned family/address

Clients may select either supported family. Confirm that every retained service address is intended and usable, or correct the publication plan.

1. The selected node address and its task outcome
2. Only one healthy node's result
3. Only the largest TTL
4. Only that some A data exists

Correct answer: A. The selected node address and its task outcome

A pooled answer can hide a failing member. Correlate each chosen destination with service correctness before diagnosing the pool as uniformly healthy.

1. Both tests asked the identical owner name
2. Question expansion changes the queried owner name
3. The dot fixes a physical link
4. The dot bypasses DNSSEC

Correct answer: B. Question expansion changes the queried owner name

The comparison isolates name construction. Read the actual question and search behavior rather than attributing the result to transport speed.

1. Notification/transfer/update behavior between the authorized servers
2. Only the secondary's process status
3. Only the primary's edit screen
4. Every client hosts file before authority comparison

Correct answer: A. Notification/transfer/update behavior between the authorized servers

The authoritative copies have diverged. Check the supported distribution mechanism and permissions rather than rely only on the primary's edit success.

1. It changes client routing
2. It prevents new records permanently
3. It proves every name and type is absent
4. It helps explain the duration and scope of cached nonexistence

Correct answer: D. It helps explain the duration and scope of cached nonexistence

Negative responses can be cached under defined rules. Record the name and TTL evidence so later differences can be interpreted without assuming immediate global refresh.

1. Assume NXDOMAIN
2. Treat the referral as terminal address data
3. Follow the relevant delegation toward an authority
4. Assume recursion has already completed

Correct answer: C. Follow the relevant delegation toward an authority

A referral identifies a next authority to consult. It is not by itself the requested record set or an application success result.

1. Automatic confidentiality
2. The responding server claims authority for the relevant answer
3. Automatic application authorization
4. Automatic DNSSEC validation

Correct answer: B. The responding server claims authority for the relevant answer

The authoritative-answer flag identifies a DNS role assertion. It should not be confused with cryptographic validation or user permission.

1. The recursive resolver or application still retains relevant state
2. All caches worldwide were cleared
3. All authoritative copies updated
4. All established connections closed

Correct answer: A. The recursive resolver or application still retains relevant state

Cache layers and connection reuse have separate lifecycles. A local action affects only the state it actually clears.

1. Only the website's TCP listener
2. Only every client's local suffix, regardless of the absolute query
3. Only the new server's successful direct answer
4. Parent delegation, needed name-server addresses, and actual selected authority path

Correct answer: D. Parent delegation, needed name-server addresses, and actual selected authority path

Normal discovery begins from the delegation path, which can differ from a manually selected direct target. Reconcile the intended parent/child information and verify recursive use.

1. Raise both TTLs so recursion can finish
2. Allow broader client TCP access without changing the aliases
3. Add PTR data while retaining the cycle
4. Replace the loop with the intended finite chain to usable terminal data

Correct answer: D. Replace the loop with the intended finite chain to usable terminal data

A cyclic alias relationship cannot yield the intended terminal address. Correct the name relationships, then verify both fresh and cached client behavior.

1. Treat the returned unsigned view as equivalent assurance
2. Change the client's subnet because authority is unreachable
3. Disable all DNSSEC validation permanently as proof of success
4. Correct signature/publication timing and verify the validation chain

Correct answer: D. Correct signature/publication timing and verify the validation chain

The validation evidence narrows the problem beyond basic reachability. Restore valid signed data and verify the intended trust path instead of simply bypassing the failed check.

1. 09:22
2. 09:20
3. 09:12 immediately
4. 19:10

Correct answer: B. 09:20

The stored interval runs from receipt at 09:10. Creating authoritative data at 09:12 does not retroactively remove this cache entry; the stated expiry remains 09:20.

1. Every cache expiring 60 seconds after the edit
2. The already cached long lifetime, independent of the new lower TTL
3. The SOA serial directly erasing each application's connections
4. DHCP renewal instantly rewriting all resolver caches

Correct answer: B. The already cached long lifetime, independent of the new lower TTL

Lowering authoritative TTL changes later answers. Existing caches may retain their previous lifetime, so preserve a suitable overlap and verify real client destinations.

1. No; stale-serving guarantees the endpoint is still correct
2. Yes; the application must have forged the DNS response
3. Yes; all implementations must discard every expired record immediately
4. No; examine the supported stale-serving policy and outage context

Correct answer: D. No; examine the supported stale-serving policy and outage context

Some resolvers support defined stale-serving behavior. Determine its scope and status; it improves continuity but does not prove the old endpoint remains suitable.

1. Only the presence of an A record in the zone file
2. Only another small UDP query
3. Only a successful server loopback TCP test
4. The large-answer query's complete fallback exchange through the required path

Correct answer: D. The large-answer query's complete fallback exchange through the required path

The failing query requires more than a small-answer test. Verify protocol-specific policy, transport opening, and the actual response under the relevant client context.

1. Only the terminal A record's current TTL
2. Only the gateway's MAC aging timer
3. Each alias-chain record and the application's selected terminal destination
4. Only the client's PTR record

Correct answer: C. Each alias-chain record and the application's selected terminal destination

Alias and address records can have separate cache lifetimes. Trace the chain used by the application instead of treating one corrected terminal answer as complete migration.

1. A guaranteed physical-layer loop
2. A need to increase every client's lease length
3. A circular discovery dependency for reaching the forwarding target
4. A harmless mismatch between MX preferences

Correct answer: C. A circular discovery dependency for reaching the forwarding target

The resolver needs a usable way to locate the upstream before querying it. Remove the circular dependency through the supported resolution/addressing design and test cold-start behavior.

1. Different intended answers can be legitimate; compare effective view and required service
2. Equal query names require globally identical responses
3. The shorter response always has the correct identity
4. Any answer difference proves poisoning

Correct answer: A. Different intended answers can be legitimate; compare effective view and required service

Split views are intentional in some designs. Verify source context and desired answer/task behavior before classifying a difference as a fault.

1. That encrypted transport guarantees the right internal endpoint
2. The intended browser resolution policy and actual namespace/service path
3. That an OS lookup proves the browser chose its address
4. That the external answer must override the internal view

Correct answer: B. The intended browser resolution policy and actual namespace/service path

Resolution policy and application context differ. Confirm the permitted path and selected destination rather than changing zone data based on an unrelated resolver test.

1. A complete inbound mail policy repair
2. Server discovery, not mail delivery readiness
3. That the mail user has the right password
4. Successful message acceptance

Correct answer: B. Server discovery, not mail delivery readiness

Name data can be correct while the service is unavailable. Follow transport and application evidence after discovering the intended exchangers.

1. Change all MX preferences to hide the stale copy
2. Restore intended update access and verify consistent current authoritative answers
3. Flush one client cache without checking the secondary
4. Permit transfers to every Internet source and test only the primary

Correct answer: B. Restore intended update access and verify consistent current authoritative answers

The secondary is an active serving dependency. Repair the authorized distribution path and validate current data on each relevant authoritative endpoint.

1. Flush every cache before examining the application's configuration
2. Use the application's exact requested name and type as the test target
3. Treat the similar-name answer as proof of application resolution
4. Change the returned address at api.school.example without confirming intent

Correct answer: B. Use the application's exact requested name and type as the test target

Similar hostnames are different questions. Evidence for one cannot establish the other's resolution; reproduce the exact request before changing infrastructure.

1. Repeatedly querying only the same warm record
2. A permitted fresh query with trace/log evidence of upstream discovery and reply
3. Using the cached answer's low latency as universal health proof
4. Checking only that the resolver's process is running

Correct answer: B. A permitted fresh query with trace/log evidence of upstream discovery and reply

Warm-cache success can hide an upstream outage. A safe uncached test and path evidence validate resolution beyond local reuse.

1. Treat the failed unrelated endpoint as proof of no SRV answer
2. Delete the SRV record because all services use 443
3. Raise the query TTL to install a listener
4. Use the discovered target and port for the intended service test

Correct answer: D. Use the discovered target and port for the intended service test

Service discovery gives a specific target/port under the application's protocol. Test that advertised endpoint rather than substitute a different owner/port combination.

1. Whether every MX target has a reverse record
2. Whether the LAN uses a /24 prefix
3. Nonexistence of the name versus absence of MX data at an existing name
4. Whether the client uses a high source port

Correct answer: C. Nonexistence of the name versus absence of MX data at an existing name

NXDOMAIN can negatively affect name use more broadly than NODATA for one type. Correct the authoritative response/data behavior and examine cached consequences.

1. The server's TCP receive window
2. The endpoint's Ethernet source address
3. The delegation path cache, rather than only the host-record cache
4. The new record's character encoding

Correct answer: C. The delegation path cache, rather than only the host-record cache

DNS resolution depends on cached discovery information as well as answer data. Track the authority selection and lifetime before claiming all caches see the new zone.

1. Cold-resolution behavior through the alternate resolver's dependencies
2. Whether a local cached address could connect
3. Whether the original client had any DNS data
4. Whether the backup resolver had an IP address

Correct answer: A. Cold-resolution behavior through the alternate resolver's dependencies

Warm state can bypass required resolution stages. Test both representative cached use and fresh discovery under the actual alternate configuration.

1. Authenticated DNS data can still be operationally wrong; verify publication intent and task identity
2. The client must ignore all validated data
3. Encryption of the query would correct the address automatically
4. DNSSEC guarantees the application deployment is correct

Correct answer: A. Authenticated DNS data can still be operationally wrong; verify publication intent and task identity

Validation protects provenance/integrity under the chain. It does not establish that an administrator chose the intended operational endpoint.

1. Only the resolver's total query count
2. The selected failing address, requested identity, certificate result, and pool publication
3. Only a claim that DNS is down
4. Only a successful test against the first address

Correct answer: B. The selected failing address, requested identity, certificate result, and pool publication

A record set can resolve correctly while one endpoint serves a wrong identity. Correlate node-specific task results and repair the relevant publication or endpoint configuration.

1. Only the client's DHCP lease
2. Only the website's return route
3. Only the zone's reverse records
4. The forwarding loop and intended authority path

Correct answer: D. The forwarding loop and intended authority path

Cyclic forwarding can prevent resolution despite reachable resolvers. Replace the loop with a supported path to authority and test a fresh question.

1. Yes; equal serials authenticate identical contents cryptographically
2. Yes; client caches must contain both copies
3. No; compare actual data, view, and serving state as well
4. Only if the answer contains IPv4

Correct answer: C. No; compare actual data, view, and serving state as well

A serial is operational version information, not a hash of all data. Configuration/views or incorrect publication can produce disagreement that the numeric comparison misses.

1. Unrestricted publication of every private host
2. Correct external publication and external task access while preserving the intended internal view
3. Only a direct LAN connection to the private address
4. Only a public PTR record for the client

Correct answer: B. Correct external publication and external task access while preserving the intended internal view

The required external path needs a suitable intended endpoint. Preserve view boundaries and test both audiences instead of globally exposing internal names.

1. Only one warm-cache lookup returning any address
2. Only the primary zone editor reporting saved
3. Consistent intended authority/delegation data, relevant cache-state checks, and task tests from required client views
4. Only a successful ping to one name server

Correct answer: C. Consistent intended authority/delegation data, relevant cache-state checks, and task tests from required client views

Completion must cover publication, discovery, cache transition, and user task under the required views. Record specific outcomes and remaining planned overlap rather than a blanket DNS-is-fixed claim.