Blocking inbound TCP port 53 connections serves to prevent unauthorized zone transfers.

• A. To prevent unauthorized zone transfers.
• B. To prevent DNS cache poisoning.
• C. To block all DNS queries from external networks.
• D. To stop remote code execution on the DNS server.

Answer: (A)

Zone transfers replicate the DNS zone data from a primary DNS server to its secondary servers and they use TCP on port 53. By blocking inbound TCP connections to port 53, you prevent remote hosts from requesting those transfers, which stops unauthorized disclosure of your zone data. Regular DNS queries, on the other hand, primarily use UDP on port 53, so normal resolution from clients can continue as long as UDP is allowed. If you need to allow legitimate transfers, you should restrict the source IPs and ideally use authentication like TSIG. This measure doesn’t directly prevent cache poisoning or remote code execution, which are addressed by different controls and defenses.