DNS questions get much easier once you stop treating DNS as one mysterious service. It is a system of records, resolvers, authoritative servers, caches, zones, and referrals. Each piece can fail in a different way.
The short version: if a device can reach an IP address but not a hostname, suspect name resolution. Then narrow it down. Check the clientâs DNS configuration, test the record type you need, compare cached and authoritative answers, and decide whether the failure affects one device, one zone, or everyone.
These questions use the kind of short troubleshooting scenarios you are likely to see while studying for CompTIA Network+ N10-009. CompTIAâs current Network+ exam overview includes DNS in networking concepts and network services. Pick an answer before opening the explanation. Guessing after reading the explanation is just reading with extra steps.
Pair this set with our Network+ common ports questions, Network+ troubleshooting questions, and Network+ subnetting questions if you want a broader study rotation.
Quick DNS review
You do not need to become a DNS server administrator to pass Network+, but you do need to know what the common pieces do.
| Item | What it does | Typical failure clue |
|---|---|---|
| Resolver | Accepts a clientâs DNS query and finds or caches the answer | One configured DNS server is unreachable |
| Authoritative server | Holds the official answer for a DNS zone | An entire domain returns the wrong record |
| Recursive query | Asks a resolver to return the final answer | Client depends on its resolver to do the lookup work |
| Iterative query | Returns the best referral available | DNS server follows referrals toward the authority |
| A record | Maps a name to an IPv4 address | Website resolves to the wrong IPv4 address |
| AAAA record | Maps a name to an IPv6 address | IPv6-capable clients get a different destination |
| CNAME record | Makes one hostname an alias of another hostname | Alias breaks while the target still resolves |
| MX record | Identifies mail servers for a domain | Other organizations cannot deliver mail to the domain |
| PTR record | Maps an IP address back to a hostname | Reverse lookup fails or mail reputation checks complain |
| TXT record | Stores text used for verification and email policy | Domain verification, SPF, DKIM, or DMARC check fails |
| SRV record | Locates a service by host and port | Clients cannot discover a directory or communications service |
| TTL | Tells caches how long they may keep a record | Old answer remains visible after a record change |
DNS normally uses port 53. UDP handles most ordinary lookups. TCP is used when a response is too large for the chosen UDP path and for operations such as zone transfers. Do not memorize âDNS equals UDP onlyâ because that answer will eventually betray you.
Network+ DNS practice questions
1. IP addresses work, hostnames fail
A workstation can ping 1.1.1.1, but ping example.com returns a name resolution error. Other computers on the same network work normally. What should the technician check first?
A. The workstationâs configured DNS server B. The switch port speed C. The websiteâs TLS certificate D. The default printer
Show answer
Answer: A. The workstationâs configured DNS server.
The device has basic IP connectivity because it can reach a public IP address. The failure appears only when it must translate a hostname. Since other computers work, start with the affected workstation: DNS server addresses, VPN settings, local cache, hosts file, and endpoint security software.
This is the cleanest DNS symptom on the exam. It also shows up constantly in support tickets described as âthe internet is down.â Our Wi-Fi troubleshooting checklist uses the same layer-by-layer approach for wireless clients.
2. A website still points to the old server
An administrator changes an A record from an old web server to a new one. The authoritative DNS server shows the new address, but some users still receive the old address for several hours. What is the most likely cause?
A. Cached records have not reached the end of their TTL B. The MX record has the wrong priority C. The users have duplicate MAC addresses D. The switch is missing a trunk port
Show answer
Answer: A. Cached records have not reached the end of their TTL.
Recursive resolvers and clients may keep the previous answer until its time to live expires. Changing the authoritative record does not force every cache on the internet to discard the old answer immediately.
A common maintenance tactic is to lower the TTL before a planned migration, wait for the old TTL window to pass, make the change, and raise the TTL later. Lowering it after the migration does not retroactively shorten records already cached under the old value.
3. Mail cannot reach the company
A companyâs website works, but external senders receive errors when emailing users at the company domain. Which DNS record should the technician inspect first?
A. MX B. PTR C. CNAME D. AAAA
Show answer
Answer: A. MX.
MX records tell sending mail systems which servers accept mail for a domain. Check that the record exists, its target is a hostname, the priorities make sense, and the target hostname resolves to an address.
The web A record can work perfectly while the mail route is broken. Different services depend on different records. If the ticket also involves mail clients or local delivery, use the email troubleshooting checklist instead of assuming DNS is the only moving part.
4. An alias needs to follow another hostname
A company wants portal.example.com to use the same hostname target as a hosted SaaS application. The provider may change its IP addresses without notice. Which record type is the best fit for the alias?
A. CNAME B. PTR C. MX D. SOA
Show answer
Answer: A. CNAME.
A CNAME makes one hostname an alias of another hostname. The provider can update the destinationâs A or AAAA records while the companyâs alias continues to point to the provider name.
A CNAME is not a general-purpose redirect. DNS does not send a browser to a different URL path, and a CNAME normally cannot coexist with other record data at the same name. The exam often checks whether you understand the difference between a hostname alias and a web redirect.
5. Reverse lookup is missing
A monitoring tool knows a serverâs IP address and needs to look up the associated hostname. Which record type supports this lookup?
A. PTR B. TXT C. SRV D. NS
Show answer
Answer: A. PTR.
PTR records support reverse DNS. Instead of asking âwhat address belongs to this name?â the resolver asks âwhat name is associated with this address?â
Reverse zones use in-addr.arpa for IPv4 and ip6.arpa for IPv6. In business environments, the owner of the IP space often controls the reverse zone. That may be the ISP or cloud provider rather than the organization using the address.
6. A client receives the wrong internal answer
Employees connected to the corporate network should resolve files.example.com to a private IP address. Internet users should receive a public address. Internal employees suddenly receive the public answer. Which DNS design should be checked?
A. Split DNS B. Link aggregation C. Port security D. Quality of service
Show answer
Answer: A. Split DNS.
Split DNS, sometimes called split-horizon DNS, returns different answers based on where the query originates. Internal resolvers can host or forward an internal version of a zone while public authoritative servers provide the external version.
Check whether the client is using the corporate resolver, whether a VPN pushed the right DNS settings, and whether the internal zone contains the expected record. A mapped drive failure may look like permissions trouble when the client is simply resolving the file server incorrectly. The network share troubleshooting checklist covers the rest of that ticket path.
7. A resolver asks the root where to go next
A DNS server queries a root server and receives a referral to the appropriate top-level domain servers rather than the final host address. What type of process is this?
A. Iterative resolution B. Address translation C. Dynamic routing D. Certificate enrollment
Show answer
Answer: A. Iterative resolution.
With an iterative query, a server returns the best information it has, often a referral to another DNS server closer to the answer. A recursive resolver follows those referrals on the clientâs behalf until it finds an authoritative answer or fails.
The client normally asks its configured resolver for a completed answer. The resolver does the walking. Keep those roles separate and the recursive-versus-iterative questions stop feeling like word games.
8. DNS works over UDP but a large answer fails
Small DNS queries succeed, but responses containing many records fail across a firewall. Packet captures show retries and an attempted switch to TCP. Which firewall rule should the technician verify?
A. TCP 53 B. TCP 25 C. UDP 161 D. TCP 3389
Show answer
Answer: A. TCP 53.
DNS commonly starts with UDP 53, but TCP 53 is also part of normal DNS operation. Large or truncated responses may retry over TCP. Zone transfers also use TCP.
A firewall policy that permits only UDP 53 can produce annoying partial failures: basic lookups work while specific responses do not. Review the Network+ common ports questions if port-and-protocol combinations still feel slippery.
9. A directory service must advertise its location
Clients need to discover which host provides a service and which port that service uses. Which DNS record is designed for service discovery?
A. SRV B. AAAA C. PTR D. MX
Show answer
Answer: A. SRV.
An SRV record identifies a serviceâs target host and port. It can also include priority and weight values. Directory and communications systems often rely on SRV records so clients can find the right service without hard-coding one server.
If clients cannot locate a domain service but direct connections to a known server work, missing or incorrect SRV records are worth checking. That is a discovery problem, not proof that the service itself is down.
10. A domain verification check fails
A SaaS provider asks the company to publish a verification token in DNS. Which record type is commonly used for this text value?
A. TXT B. A C. PTR D. NS
Show answer
Answer: A. TXT.
TXT records store text strings used for domain verification and email policy systems such as SPF, DKIM, and DMARC. The record name and exact value matter. Extra quotation marks, publishing under the wrong subdomain, or checking through a stale cache can cause a verification failure.
Do not assume every TXT record controls email. The recordâs name and content tell you what system uses it.
11. The primary DNS server has zone data, but the secondary does not
A secondary DNS server cannot copy zone updates from the primary. Normal client lookups still work. Which traffic should the administrator verify between the two DNS servers?
A. TCP 53 for zone transfers B. UDP 67 for DHCP leases C. TCP 443 for web browsing D. UDP 123 for time synchronization
Show answer
Answer: A. TCP 53 for zone transfers.
Full and incremental zone transfers use TCP 53. The secondary may continue answering from older zone data, which makes this failure less obvious than a complete outage.
Also verify that the primary permits transfers to the correct secondary server and that zone serial numbers advance as expected. Opening TCP 53 to the entire internet is not the fix. Limit transfers to authorized servers.
12. A user connects to VPN but internal names do not resolve
A remote employee connects to the company VPN and can reach an internal server by private IP address. The employee cannot reach the same server by its internal hostname. Office users are unaffected. What should the technician inspect first?
A. DNS server and suffix settings delivered by the VPN B. The office switchâs spanning-tree priority C. The public websiteâs certificate D. The employeeâs monitor cable
Show answer
Answer: A. DNS server and suffix settings delivered by the VPN.
The private IP works, so the VPN has a route to the internal network. Name resolution is the missing piece. Check which resolver the VPN client uses, whether the internal DNS suffix search list is present, and whether split tunneling sends DNS queries down the intended path.
Our VPN troubleshooting checklist walks through routing, authentication, DNS, and client checks in an order that keeps you from changing five things at once.
13. One poisoned answer sends users to the wrong server
Users who query a particular resolver receive a fraudulent IP address for a banking site. The authoritative DNS records are correct. Which attack best matches the symptom?
A. DNS cache poisoning B. VLAN hopping C. Evil twin access point D. MAC flooding
Show answer
Answer: A. DNS cache poisoning.
Cache poisoning inserts a false DNS answer into a resolverâs cache. Clients trust the resolver and receive the malicious destination until the bad record is removed or expires.
Defenses include patched DNS software, unpredictable query identifiers and source ports, restricted recursion, DNSSEC validation where supported, and monitoring for unexpected answers. DNSSEC helps validate signed DNS data; it does not encrypt ordinary DNS queries. For more network defense scenarios, use the Network+ network security questions.
14. IPv4 resolution works, but the IPv6 record is wrong
A hostnameâs A record points to the correct server. Its AAAA record points to an old IPv6 address. Some modern clients fail or take a long time before connecting. Which change addresses the root cause?
A. Correct or remove the stale AAAA record B. Increase the MX priority C. Replace the switch with a hub D. Add a second PTR record for the IPv4 address
Show answer
Answer: A. Correct or remove the stale AAAA record.
AAAA records provide IPv6 addresses. A client that prefers or tries IPv6 may follow the bad record even though the IPv4 A record is correct. This can create inconsistent reports because IPv4-only clients work normally.
Test record types separately. nslookup, dig, and PowerShellâs Resolve-DnsName can ask specifically for A or AAAA data. âDNS resolvesâ is not a complete test when the name has several record types.
15. DHCP clients receive the wrong DNS server
Every laptop on one VLAN can obtain an IP address and default gateway, but all of them receive an old DNS server address. Statically configured devices work. Where should the technician correct the setting?
A. The DHCP scope options for that VLAN B. The public domainâs MX record C. The wireless channel width D. The DNS root hints on every laptop
Show answer
Answer: A. The DHCP scope options for that VLAN.
DHCP commonly supplies clients with DNS server addresses and a DNS suffix. If every dynamic client on one subnet receives the same bad value, check the scope or policy serving that subnet. Renew the lease after correcting it so clients receive the new option.
The clue is scope. One user suggests a local problem. One VLAN of DHCP clients suggests a shared configuration. If VLAN boundaries and relay behavior need work, rotate through the Network+ VLAN questions and Network+ routing questions.
A DNS troubleshooting order that works
When a scenario dumps six clues on you, use a fixed order:
- Confirm IP connectivity to the destination or another known address.
- Check the clientâs DNS server addresses and DNS suffix.
- Query the exact hostname and record type.
- Try a second resolver if policy allows it.
- Compare the recursive answer with the authoritative answer.
- Check TTL and caches after recent changes.
- Decide whether the scope is one client, one subnet, one resolver, one zone, or the whole organization.
Useful commands include:
Resolve-DnsName app.example.com -Type A
Resolve-DnsName app.example.com -Type AAAA
ipconfig /displaydns
ipconfig /flushdnsdig app.example.com A
dig app.example.com AAAA
dig +trace app.example.comFlushing a client cache can prove that a stale local answer was involved. It is not a universal DNS repair. If the recursive resolver holds the stale answer or the authoritative record is wrong, clearing one laptop changes nothing useful.
The same discipline applies outside DNS. The Network+ troubleshooting practice set focuses on picking the next test instead of firing random fixes at the network.
How to study these questions
Do a first pass without notes. Mark each miss by concept rather than question number: records, query flow, ports, caching, client configuration, or security. Then review the weak concept and retake the missed questions a day later.
You should be able to explain why each wrong option is wrong. On question 12, for example, âVPN DNS settingsâ is not correct merely because the question says VPN. It is correct because the private IP works, office users work, and only internal hostname resolution fails for the remote client.
Use the IT certification topic hub to build the rest of your study plan. If you need another dedicated Network+ set, choose wireless, common ports, subnetting, or network security based on what you missed here. You can also compare Network+ study guide options before buying another book you will use as a monitor stand.
FAQ
Is DNS still covered on Network+ N10-009?
Yes. CompTIA lists DNS among the protocols and network services covered by the current N10-009 exam. The exam can test record purposes, ports, resolution flow, configuration, security, and troubleshooting through multiple-choice or performance-based scenarios.
Do I need to memorize every DNS record?
Focus first on A, AAAA, CNAME, MX, PTR, TXT, SRV, NS, and SOA. Know what TTL does and understand the difference between recursive resolvers and authoritative servers. Obscure record types are a worse use of study time than getting the common ones right in realistic scenarios.
Does DNS use TCP or UDP port 53?
Both. Most ordinary queries use UDP 53. TCP 53 supports zone transfers and can handle responses that do not fit the UDP path. If an answer says DNS uses only UDP, be suspicious.
What is the difference between a resolver and an authoritative DNS server?
A resolver finds answers for clients and may cache them. An authoritative server publishes official data for zones it serves. A resolver can return a cached answer without contacting the authoritative server for every query.
What should I study after DNS?
Study DHCP and IP addressing next if client configuration caused trouble. Move to routing and VLANs if you missed scope or path questions. If ports were the problem, review the common ports practice set. The goal is to fix the weak layer, not collect tabs.