RANGER GAMEZ

CompTIA Network+ (N10-009) · chapter 17 of 29

Week 17: Names and time

In this chapter Objectives 3.4, 5.5

  1. DNS
  2. Time protocols
  3. Tools: nslookup and dig
  4. Practice questions
  5. Chapter recap

Objective 3.4

DNS

Record types

Know the records cold:

  • A: name to IPv4 address
  • AAAA: name to IPv6 address
  • CNAME: alias pointing to another name (shop -> web01)
  • MX: mail server for the domain, with priority (lower = preferred)
  • TXT: free text, used for SPF, DKIM, domain verification
  • NS: which name servers are authoritative for the zone
  • PTR: IP address back to a name (reverse lookup)

Zones: forward and reverse

A forward zone answers name-to-IP questions (A, AAAA, CNAME, MX). A reverse zone answers IP-to-name with PTR records, under in-addr.arpa for IPv4 (10.1.8.20 -> 20.8.1.10.in-addr.arpa) and ip6.arpa for IPv6.

Exam tip Mail servers and logs often check reverse DNS. Missing PTR = rejected mail or ugly logs.

Who answers: authoritative, primary, secondary

An authoritative server holds the zone and gives the official answer. A non-authoritative answer comes from some server's cache. The primary server holds the editable copy of the zone; secondary servers keep read-only copies via zone transfers for redundancy.

Exam tip nslookup printing 'Non-authoritative answer' just means it came from a cache. It is not an error.

Recursive lookups and the hosts file

Your PC asks a recursive resolver to do the full work: the resolver queries root, then TLD, then the authoritative server, caches the result and returns it. Before DNS, most OSes check the local hosts file (Windows: C:\Windows\System32\drivers\etc\hosts, Linux: /etc/hosts). A stale entry there overrides DNS.

A DNS lookup in numbered steps. First the PC checks its local hosts file. 1: it asks its recursive resolver. 2: the resolver asks a root server, which points to the top-level domain servers. 3: it asks the TLD server, which points to the domain's authoritative server. 4: it asks the authoritative server, which answers with the address. 5: the resolver caches the answer and returns it to the PC.
The resolver does the legwork: root, then TLD, then authoritative; then it caches the answer.

Exam tip One PC resolves a name wrong but nslookup is right? nslookup asks DNS directly and skips the hosts file. Check hosts.

DNSSEC, DoH, DoT

DNSSEC adds digital signatures to records so resolvers can verify they are authentic and unchanged. It does not encrypt. DNS over HTTPS (DoH) (port 443) and DNS over TLS (DoT) (port 853) encrypt queries so others on the path cannot read or alter them.

Exam tip DNSSEC = integrity and authenticity (signed). DoH/DoT = privacy (encrypted). Different problems.

Objective 3.4

Time protocols

NTP, PTP, NTS

NTP (UDP 123) syncs clocks to within milliseconds using a hierarchy of strata (stratum 0 = atomic/GPS source, 1 = server attached to it). PTP (Precision Time Protocol, IEEE 1588) uses hardware timestamps for sub-microsecond accuracy, used in finance, telecom and industrial systems. NTS (Network Time Security) adds TLS-based authentication to NTP so clients can trust the time source.

Exam tip Why time matters: Kerberos logons fail with clock skew over 5 minutes, and logs can't be correlated if clocks disagree.

Objective 5.5

Tools: nslookup and dig

nslookup and dig

nslookup (Windows, Linux, macOS) and dig (Linux/macOS) query DNS directly. Both can ask a specific server and a specific record type. dig gives more detail: flags, TTLs, and which server answered.

$ dig kibbleco.example MX +noall +answer
kibbleco.example. 3600 IN MX 10
    mx1.kibbleco.example.
kibbleco.example. 3600 IN MX 20
    mx2.kibbleco.example.

C:\> nslookup -type=ptr 10.1.8.20
20.8.1.10.in-addr.arpa
    name = web01.kibbleco.example

Exam tip 'dig @10.1.8.5 shop.kibbleco.example' asks one server directly: great for checking a new record before caches expire.

Check yourself 1Priya wants DNS answers to be provably authentic and unaltered, even from caches. Which technology adds that?

  1. A secondary zone
  2. DNS over HTTPS
  3. DNSSEC
  4. DNS over TLS
Show the answer

Answer: C. DNSSEC

DNSSEC signs records so resolvers can validate them. DoH and DoT encrypt the query path but do not sign the data.

Practice questions

Answer in your head, then open the answer. Ranger's Packet Trail has 483 questions like these for Network+, with mock exams.

Question 1What is the correct order of the DHCP lease process for a new IPv4 client?

  1. Discover, Request, Offer, Acknowledge
  2. Discover, Offer, Request, Acknowledge
  3. Request, Offer, Discover, Acknowledge
  4. Offer, Discover, Acknowledge, Request
Show the answer

Answer: B. Discover, Offer, Request, Acknowledge

DHCP is DORA: the client broadcasts Discover, servers send Offer, the client sends Request, and the chosen server sends Acknowledge.

Question 2An IPv6 host configures its own global address from the prefix in a router advertisement, without any DHCPv6 server. What is this method called?

  1. SLAAC
  2. DHCPv6 relay
  3. APIPA
  4. NAT64
Show the answer

Answer: A. SLAAC

Stateless address autoconfiguration (SLAAC) lets hosts build an address from the router-advertised prefix plus an interface ID (EUI-64 or random).

Question 3A host uses SLAAC with EUI-64. Its MAC address is 00:1A:2B:3C:4D:5E. Which interface ID will it build?

  1. 001a:2b3c:4d5e:fffe
  2. 001a:2bff:fe3c:4d5e
  3. 021a:2bff:fe3c:4d5e
  4. 021a:2bfe:ff3c:4d5e
Show the answer

Answer: C. 021a:2bff:fe3c:4d5e

EUI-64 splits the MAC in half, inserts FFFE in the middle and flips the 7th bit of the first byte: 00 becomes 02. Result 021a:2bff:fe3c:4d5e.

Question 4A printer should always get 10.1.20.40 through its DHCP reservation, but it keeps getting a different address. Its ipconfig shows MAC 3C-52-82-11-9A-70 and IP 10.1.20.112. Based on the scope in the exhibit, what is the cause?

  1. The reserved address falls inside the exclusion range
  2. The reservation's MAC does not match the printer's MAC
  3. The scope has no relay agent configured for VLAN 20
  4. The 8-day lease time is overriding the reservation
Show the answer

Answer: B. The reservation's MAC does not match the printer's MAC

A reservation is matched by the client's MAC (client ID). The scope lists ...9A:07 but the printer is ...9A:70, so the server treats it as an unknown client and leases from the pool. The excluded range ends at .30, so .40 is not excluded.

Question 5Which DNS record maps a hostname to an IPv6 address?

  1. AAAA
  2. PTR
  3. CNAME
  4. A
Show the answer

Answer: A. AAAA

AAAA (quad-A) records map names to IPv6 addresses. A records map names to IPv4 addresses.

Practice it in Ranger's Packet TrailThe same lessons as a story, with drills, hands-on labs and mock exams. Free, in your browser.
Play free

CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.