Your network contains an Active Directory domain named contoso.com.
You run nslookup.exe as shown in the following Command Prompt window.

You need to ensure that you can use Nslookup to list all of the service location (SRV)
resource records for contoso.com.
What should you modify?

A.
the root hints of the DNS server

B.
the security settings of the zone

C.
the Windows Firewall settings on the DNS server

D.
the zone transfer settings of the zone

Explanation:
http://www.c3.hu/docs/oreilly/tcpip/dnsbind/ch11_07.htm
11.7 Troubleshooting nslookup Problems
11.7.4 Query Refused
Refused queries can cause problems at startup, and they can cause lookup failures during a
session. Here’s what it looks like when nslookup exits on startup because of a refused
query:
% nslookup
*** Can’t find server name for address 192.249.249.3: Query refused
*** Default servers are not available
%
This one has two possible causes. Either your name server does not support inverse queries
(older nslookups only), or zone security is stopping the lookup.
Zone security is not limited to causing nslookup to fail to start up. It can also cause lookups
and zone transfers to fail in the middle of a session when you point nslookup to a remote
name server. This is what you will see:
% nslookup
Default Server: hp.com
Address: 15.255.152.4
> server terminator.movie.edu
Default Server: terminator.movie.edu
Address: 192.249.249.3
> carrie.movie.edu.
Server: terminator.movie.edu
Address: 192.249.249.3
*** terminator.movie.edu can’t find carrie.movie.edu.: Query refused
> ls movie.edu – This attempts a zone transfer
[terminator.movie.edu]
*** Can’t list domain movie.edu: Query refused