To block all DNS requests from subnet 10.107.149.0/24, which expression matches traffic to UDP or TCP port 53 from that subnet?

To block all DNS requests from subnet 10.107.149.0/24, which expression matches traffic to UDP or TCP port 53 from that subnet?

• A. CLIENT.IP.SRC.IN_SUBNET(10.107.149.0/24) II client.TCP.DSTPORT.EQ(53)
• B. CLIENT.IP.SRC.IN_SUBNET(10.107.149.0/24) && (client.UDP.DSTPORT.EQ(53) || client.TCP.DSTPORT.EQ(53))
• C. CLIENT.IP.SRC(10.107.149.0) && (client.UDP.DSTPORT.EQ(53) || client.TCP.DSTPORT.EQ(53))
• D. CLIENT.IP.SRC(10.107.149.0) && client.UDP.DSTPORT.EQ(53) || client.TCP.DSTPORT.EQ(53)

Answer: (B)

To block all DNS requests from that subnet, you need to require both the source being in the /24 and the destination port being 53, for either UDP or TCP. The expression that does this uses IN_SUBNET to match 10.107.149.0/24 and then checks that the destination port is 53 for either UDP or TCP, combining those checks with an AND and a grouped OR for the two transport protocols: UDP or TCP DSTPORT equals 53. This is best because it precisely targets DNS traffic from that specific subnet, regardless of whether DNS uses UDP or TCP. The grouped OR ensures both UDP and TCP DNS traffic are covered, while the AND ensures only traffic that originates from the specified subnet is considered. The other options fall short: they either test only TCP or UDP or use the subnet incorrectly (single IP instead of a /24), or they lack proper grouping/precedence, which can lead to matching unintended traffic or missing DNS requests from the subnet.

To block all DNS requests from that subnet, you need to require both the source being in the /24 and the destination port being 53, for either UDP or TCP. The expression that does this uses IN_SUBNET to match 10.107.149.0/24 and then checks that the destination port is 53 for either UDP or TCP, combining those checks with an AND and a grouped OR for the two transport protocols: UDP or TCP DSTPORT equals 53.

This is best because it precisely targets DNS traffic from that specific subnet, regardless of whether DNS uses UDP or TCP. The grouped OR ensures both UDP and TCP DNS traffic are covered, while the AND ensures only traffic that originates from the specified subnet is considered. The other options fall short: they either test only TCP or UDP or use the subnet incorrectly (single IP instead of a /24), or they lack proper grouping/precedence, which can lead to matching unintended traffic or missing DNS requests from the subnet.