a systems administrator is trying to harden an external facing dns server and wants to disable every port except for dns. which port should they leave open?