A DNS zone transfer involves replicating the DNS zone data (e.g., all records for a domain) from a

primary to a secondary DNS server, requiring a reliable transport mechanism.

Why A is correct: DNS zone transfers use TCP port 53 because TCP ensures reliable, ordered delivery

of data, which is critical for transferring large zone files. CNSP notes that TCP is the standard protocol

for zone transfers (e.g., AXFR requests), as specified in RFC 5936.

Why other options are incorrect:

B . 53/UDP: UDP port 53 is used for standard DNS queries and responses due to its speed and lower

overhead, but it is not suitable for zone transfers, which require reliability over speed.

C . Both 1 and 2: This is incorrect because zone transfers are exclusively TCP-based, not UDP-based.

D . None of the above: Incorrect, as 53/TCP is the correct port for DNS zone transfers.

Reference: CNSP "DNS Security Practices" (Section on Zone Transfers) specifies TCP port 53 as the

protocol for secure and reliable zone transfer operations.