Week 3 Day 5 — NETW-0014

0:00–0:30
Written

0:30–1:45
Practical

1:45–2:00
Review + Preview W5

Before 0:00Instructor setup

Written assessment sheets face-down on each desk.
Practical zone specification prepared — a different domain name from the student's own zone (e.g. exam.net), with a list of records to create and a secondary server to configure. Do not reuse yourname.net — students must build fresh, not copy.
On board: Written — 30 min, pen and paper. Practical — 75 min, all VMs, man pages allowed, no internet, no notes.

0:00 – 0:30Written · 30 min · 30% of Mini-Assessment 3

Written — DHCP and DNS concepts, zone file syntax, record types

Pen and paper. No computer. 30 minutes.

Section A — DHCP (12 marks)

Q1 (4 marks): Describe the DORA process. For each step: what type of packet is sent, what addresses are used (source and destination), and what information it carries.
Q2 (3 marks): Write a minimal dhcpd.conf scope for the network 192.168.100.0/24 that: assigns addresses from .50 to .150, provides a default gateway of .1, sets default lease to 12 hours, and sets max lease to 3 days. Show the complete syntax including braces and semicolons.
Q3 (2 marks): What file stores DHCP leases on the server? Write one directive you would add to dhcpd.conf to make DHCP events log to a dedicated file using rsyslog's local0 facility.
Q4 (3 marks): A student configures a MAC-based reservation in dhcpd.conf, restarts the server, but the client still gets an address from the pool instead of the reserved address. List three reasons this could happen.

Section B — DNS (18 marks)

Q5 (3 marks): Describe the role of each BIND9 configuration file: named.conf.options, named.conf.local, named.conf.default-zones.
Q6 (2 marks): In a zone file for example.net, explain what happens when each of the following is used as the target of an NS record. Identify which is correct:
a) ns1 b) ns1.example.net c) ns1.example.net.
Q7 (5 marks): Identify what record type each of the following requires, and write the zone file entry:
a) Map hostname mail to IP 192.168.1.10
b) Make ftp an alias pointing to s1
c) Map IP 192.168.1.10 back to mail.example.net (in a reverse zone for 192.168.1.0/24)
d) Declare ns1 as the authoritative nameserver for the zone
e) Declare a mail exchanger with priority 10 pointing to mail
Q8 (3 marks): What is the SOA serial number convention? A zone file has serial 2024112101. You make two changes the same day. What should the new serial be? What happens if you forget to increment the serial before reloading?
Q9 (2 marks): Write the zone declaration for a secondary DNS server for the zone example.net, where the primary server is at 10.0.0.1.
Q10 (3 marks): Why should zone transfers be restricted? Write the named.conf.local directive that restricts AXFR to only 192.168.50.2. What does dig @server example.net AXFR return when this restriction is in place and you are not the allowed host?

0:30 – 1:45Practical · 75 min · 70% of Mini-Assessment 3

Build a complete DNS zone from a specification — forward zone, reverse zone, secondary server

Students receive the specification below. No notes, no internet. Man pages (man named, man named-checkzone) allowed. 75 minutes.

Zone specification

Domain: exam.net — build this as a new zone on S1. Do not modify your existing yourname.net zone.
Records required:
· server1.exam.net → 192.168.50.1
· server2.exam.net → 192.168.50.2
· server3.exam.net → 192.168.51.2
· www.exam.net → alias for server1
· ftp.exam.net → alias for server1
· Reverse PTR records for 192.168.50.1 and 192.168.50.2
Secondary server: Configure S2 as a secondary server for exam.net. Zone transfer must succeed and be confirmed in S2's BIND9 log.
Restrictions: Zone transfers restricted to S2 only — dig @S1 exam.net AXFR from S3 must return REFUSED.

Marking criteria

Task	Marks	Verified by
named-checkzone passes for forward zone	10	Student runs command and shows instructor output
All A records resolve: server1, server2, server3	15	dig @S1 [hostname].exam.net returns correct IP
CNAME records resolve: www and ftp → server1's IP	10	dig @S1 www.exam.net and ftp.exam.net
Reverse PTR records resolve for .50.1 and .50.2	15	dig @S1 -x 192.168.50.1 and -x 192.168.50.2
S2 zone transfer successful — log evidence	15	journalctl -u named on S2 shows "Transfer status: success"
S2 can answer queries for exam.net	5	dig @S2 server1.exam.net
AXFR refused from S3 (allow-transfer enforcement)	5	dig @S1 exam.net AXFR from S3 returns REFUSED

1:45 – 2:00Review + Week 4 Preview · 15 min

Most common mistakes: serial number not changed (secondary doesn't transfer because serial is the same as last time), PTR targets missing trailing dot (BIND loads the zone but reverse lookups return wrong names), in-addr.arpa notation wrong (common confusion: the zone name for 192.168.50.0/24 is 50.168.192.in-addr.arpa, not 192.168.50.in-addr.arpa).
Preview Week 4: "The yourname.net DNS zone you built this week has an A record for s1.yourname.net. Next week we install Nginx on S1 and configure a virtual host that responds to requests for www.yourname.net — which you also have in the zone as a CNAME. The DNS you built today makes the Nginx configuration work. Week 3 is the foundation."
Also in Week 4: advanced DNS views (split-horizon), and the Nginx log-driven troubleshooting module. Ensure yourname.net is working cleanly before Monday — the Nginx lab depends on it.

Mini-Assessment 3 — marking summary

Component	Format	Weight	Key topics
Written — Section A (DHCP)	Short answer + config	12 marks (30%)	DORA process, dhcpd.conf syntax, logging directive, reservation troubleshooting
Written — Section B (DNS)	Short answer + config	18 marks (30%)	BIND9 files, trailing dot rule, record types, SOA serial, secondary zone, allow-transfer
Practical — Forward zone	Live demonstration	35 marks (70%)	named-checkzone, A records, CNAME records, all verified with dig
Practical — Reverse zone	Live demonstration	15 marks (70%)	PTR records verified with dig -x
Practical — Secondary + restrictions	Live demonstration	25 marks (70%)	Zone transfer log, S2 answering queries, AXFR refused from S3