Examkin

Question

Difficulty: MediumDeception and Disruption Technologies

During an active incident response, a security analyst identifies multiple compromised internal workstations attempting to establish connections to a known malicious command-and-control (C2) domain. To immediately disrupt these communications enterprise-wide and capture telemetry from infected hosts without deploying host agents or creating custom firewall drop rules for every host, the analyst configures internal name servers to resolve queries for the C2 domain to an isolated monitoring IP address. Which deception or disruption technology is being utilized in this scenario?

  1. DNS sinkholingAnswer
  2. B
    High-interaction honeynet
  3. C
    Honeyfile deployment
  4. D
    Stateful firewall inspection

Answer

DNS sinkholing is the correct technology being utilized to redirect malicious domain resolution requests to a security-monitored IP address.
DNS sinkholing works by configuring a DNS server to return false or redirected IP addresses (sinkhole IP addresses) for specific malicious domain names. When infected hosts attempt to resolve the C2 server domain, the DNS server redirects the connection attempt to an internal security monitoring host. This immediately disrupts malware communication while allowing the security team to identify every infected machine querying that domain.

Step-by-Step Solution

1
Analyze the operational objective in the scenario.
The goal is to disrupt malware command-and-control traffic and log infected hosts by manipulating domain name resolution across internal name servers.
Identifying the primary operational mechanism reveals whether the control relies on deception lures, decoy assets, or network resolution redirection.
2
Evaluate deception and disruption technology definitions.
DNS sinkholing specifically intercepts domain queries destined for known malicious hosts and returns a controlled IP address (such as a loopback address or monitoring sinkhole).
This technique provides rapid disruption of C2 channels while capturing traffic logs from all infected internal devices querying the domain.
3
Distinguish DNS sinkholing from decoy host and file controls.
Unlike honeypots, honeynets, or honeyfiles—which rely on decoy resources to entice threat actors—DNS sinkholing operates at the infrastructure level to intercept and divert malicious traffic.
Confirming the exact functional layer ensures accurate control selection.

Key Concept

DNS Sinkholing as a Disruption and Detection Technology
Rate this question

Topics

Deception and Disruption Technologies

More questions from this topic