Which expression would match DNS requests from subnet 172.16.0.0/12 for UDP or TCP port 53?

Which expression would match DNS requests from subnet 172.16.0.0/12 for UDP or TCP port 53?

• A. CLIENT.IP.SRC.IN_SUBNET(172.16.0.0/12) && (client.UDP.DSTPORT.EQ(53) || client.TCP.DSTPORT.EQ(53))
• B. CLIENT.IP.SRC.IN_SUBNET(172.16.0.0/12) II (client.UDP.DSTPORT.EQ(53) || client.TCP.DSTPORT.EQ(53))
• C. CLIENT.IP.SRC(172.16.0.0/12) && (client.UDP.DSTPORT.EQ(53) || client.TCP.DSTPORT.EQ(53))
• D. CLIENT.IP.SRC(172.16.0.0/12) && client.UDP.DSTPORT.EQ(53) || client.TCP.DSTPORT.EQ(53)

Answer: (A)

Matching DNS requests from a specific subnet means checking both the source IP falls inside that CIDR and the destination port is 53 for either UDP or TCP. Use IN_SUBNET(172.16.0.0/12) to verify the source subnet, and test both UDP and TCP ports for 53, combining the port checks with OR inside parentheses and then linking that group to the subnet check with AND. This ensures only traffic from 172.16.0.0/12 that uses DNS (port 53 via UDP or TCP) is matched. The correct approach does this: the subnet test must be true AND (UDP port 53 OR TCP port 53). Using OR between the subnet test and the port checks would let non-subnet traffic slip through if DNS port 53 is used, and writing the IP check as IP.SRC(172.16.0.0/12) can be invalid for CIDR matching. Also, missing parentheses can cause the logic to be evaluated as (subnet AND UDP 53) OR TCP 53, which would match TCP DNS traffic from any source.

Matching DNS requests from a specific subnet means checking both the source IP falls inside that CIDR and the destination port is 53 for either UDP or TCP. Use IN_SUBNET(172.16.0.0/12) to verify the source subnet, and test both UDP and TCP ports for 53, combining the port checks with OR inside parentheses and then linking that group to the subnet check with AND. This ensures only traffic from 172.16.0.0/12 that uses DNS (port 53 via UDP or TCP) is matched.

The correct approach does this: the subnet test must be true AND (UDP port 53 OR TCP port 53). Using OR between the subnet test and the port checks would let non-subnet traffic slip through if DNS port 53 is used, and writing the IP check as IP.SRC(172.16.0.0/12) can be invalid for CIDR matching. Also, missing parentheses can cause the logic to be evaluated as (subnet AND UDP 53) OR TCP 53, which would match TCP DNS traffic from any source.