Exam SY0-501 topic 1 question 952 discussion

DNSSEC uses TCP 53

My screen still shows D and E!! They change it back? Read here "Furthermore, most organizations have also used firewalls to block TCP port 53 to and from their DNS servers and the Internet. This is double-protection in case the DNS server accidentally allowed transfers. Configuring your DNS servers to permit zone transfers to only legitimate DNS servers has always been and continues to be a best practice. However, the practice of denying TCP port 53 to and from DNS servers is starting to cause some problems. There are two good reasons that we would want to allow both TCP and UDP port 53 connections to our DNS servers. One is DNSSEC and the second is IPv6." FROM https://www.networkworld.com/article/2231682/cisco-subnet-allow-both-tcp-and-udp-port-53-to-your-dns-servers.html Maybe this is a new 601 question....things are changing....it could also be that it mentions internal DNS, not facing the net, so in that case they could allow for tcp, so long as they have all access from the internet blocked off....another stupid question without all the info to make a decision