Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

During a system inspection, a security auditor reviews the following excerpt from an internal DNS server transaction log:

27-Jul-2026 14:02:11.104 queries: info: client @0x7f8a10 192.168.10.45#51204 (a3V4b2ExOTI4M2E4MTI3.exfil.badsite.com): query: a3V4b2ExOTI4M2E4MTI3.exfil.badsite.com IN TXT + (192.168.10.1)
27-Jul-2026 14:02:11.215 queries: info: client @0x7f8a10 192.168.10.45#51205 (bTl4YTE5MjgzYTgxMjg.exfil.badsite.com): query: bTl4YTE5MjgzYTgxMjg.exfil.badsite.com IN TXT + (192.168.10.1)
27-Jul-2026 14:02:11.330 queries: info: client @0x7f8a10 192.168.10.45#51206 (Yzg5YTE5MjgzYTgxMjk.exfil.badsite.com): query: Yzg5YTE5MjgzYTgxMjk.exfil.badsite.com IN TXT + (192.168.10.1)

Based on the observed log pattern, which of the following activities is taking place?

  1. DNS tunneling utilized for covert data exfiltrationAnswer
  2. B
    A SQL injection attack targeting the internal database backend
  3. C
    An authorization failure caused by invalid access permissions
  4. D
    A false positive generated by a misconfigured preventive host firewall rule

Answer

DNS tunneling utilized for covert data exfiltration
The correct answer identifies DNS tunneling for data exfiltration. The log snippet shows rapidly repeating DNS queries for TXT records containing long, high-entropy, base64-encoded subdomains appended to an external domain. Because standard firewalls allow outbound DNS traffic on UDP port 53, threat actors use DNS queries to encode and exfiltrate sensitive data in small chunks.

Step-by-Step Solution

1
Examine the log query type and payload structure
Identified repeated DNS queries requesting TXT records with long, randomized, base64-encoded strings as subdomains (e.g., a3V4b2ExOTI4M2E4MTI3).
DNS TXT records allow arbitrary text data transport, which attackers abuse to encode and package sensitive payload information.
2
Analyze request frequency and destination host pattern
Observed multiple rapid queries originating from a single internal IP (192.168.10.45) querying unique subdomains under a common root (exfil.badsite.com).
High-frequency queries with unique encoded prefixes directed to an external authoritative name server indicate automated data chunking over DNS protocol.
3
Correlate telemetry indicators with threat behavior
Concluded that the telemetry matches DNS tunneling/exfiltration techniques.
Encoding payload chunks inside DNS hostname lookups bypasses standard perimeter firewalls that permit outbound port 53 traffic.

Key Concept

DNS Log Analysis and DNS Tunneling Detection
Estimated Time:1m 30s
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic